Overview

overview

6

Static

static

3

2026-07-11...ee.exe

windows10-2004-x64

6

2026-07-11...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    125s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    11/07/2026, 18:43

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-11_46e9e64f567d9d87be54794ce01136a9_elex_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.7MB
  • Sample260711-xc32psht5p
  • SHA256 1e9254b957fd23298cbd6a781d9c1bff318394a7806f41f01bfe4bf243894e17
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 2 IoCs
  • Drops file in Program Files directory 38 IoCs
  • Drops file in Windows directory 62 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_46e9e64f567d9d87be54794ce01136a9_elex_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-11_46e9e64f567d9d87be54794ce01136a9_elex_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:1776
  • C:\Users\Admin\AppData\Local\Temp\2026-07-11_46e9e64f567d9d87be54794ce01136a9_elex_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-11_46e9e64f567d9d87be54794ce01136a9_elex_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:4120

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        Decryptiond3dcompiler4367.0.3397.119.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\Decryptiond3dcompiler4367.0.3397.119.exe
        • Size 9.1MB
        • SHA256 4c748abd5ed8e9673de5b292f0b27b0ff7e682d42acc7c907abce1728d01eb5e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        libGLESv2libEGL.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\libGLESv2libEGL.exe
        • Size 1.5MB
        • SHA256 19deafba49ea43c98d1d6dd3f7259222094fd36691893b79adfd99e30b0c68f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WCChromeNativeMessagingHostCreate.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Browser\WCChromeExtn\WCChromeNativeMessagingHostCreate.exe
        • Size 1.7MB
        • SHA256 e18d025702f63dbc0297169741cb619906b0cb51f49236e60ca5a4b5bd4240bf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ViewerPSAcrofx32.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ViewerPSAcrofx32.exe
        • Size 1.7MB
        • SHA256 6b0602d4dafda80df8724dddc053be262476f739678df8ac8db2f61d8ab0842e
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        icudt58cryptocme.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\icudt58cryptocme.exe
        • Size 1.6MB
        • SHA256 64ee594ec61102058a75c039b088305cae5c4e4fe098598177fb8e7fa0a4aae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSTOLoaderUIVSTOInstallerUI.exe
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\VSTO\10.0\1033\VSTOLoaderUIVSTOInstallerUI.exe
        • Size 1.7MB
        • SHA256 9d45e52e9685f141ed91111d9e18f02fdd9d7e9b5e6e2e91f324a7d58d296262
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Sistemaoperativo.exe
        • Path C:\Program Files (x86)\Common Files\Microsoft Shared\ink\es-ES\Sistemaoperativo.exe
        • Size 1.7MB
        • SHA256 e93156893bea91cbfe85cc484454fb95a95ebb92c79aa6e2953deaa867f01f4f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msedgepwalauncherHost.exe
        • Path C:\Program Files (x86)\Microsoft\EdgeCore\122.0.2365.106\msedgepwalauncherHost.exe
        • Size 2.0MB
        • SHA256 829fda8cf5791d49af000007715508caaa02aecc7b0cdeebbba3b2e4225b0914
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SystemMicrosoft2.0.50727.9157.exe
        • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\DE\SystemMicrosoft2.0.50727.9157.exe
        • Size 1.8MB
        • SHA256 fbc0a53da79a90f1be9de9c8fa9fc42425d02385d4d850d5294448ea6cfd417b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SystemWindows.exe
        • Path C:\Windows\Microsoft.NET\Framework\v2.0.50727\it\SystemWindows.exe
        • Size 1.8MB
        • SHA256 20b3af6dc87ff6e39901183f0eb90f4532e7d7920f639ea363879c7d03c8a967
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download