Overview

overview

6

Static

static

3

2026-07-19...ee.exe

windows10-2004-x64

6

2026-07-19...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    124s
  • max time network
    132s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260710-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    20/07/2026, 01:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-19_68a4f5e56f9343fa8ead6ce36098ec9c_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
  • Size 945KB
  • Sample260720-brjqqady9v
  • SHA256 cd8b258f72089aa4a98c32f12305fd0d6cc501eaaa99cd37e96d28be1e1b36ba
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 3 IoCs
  • Drops file in Program Files directory 29 IoCs
  • Drops file in Windows directory 64 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 62 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_68a4f5e56f9343fa8ead6ce36098ec9c_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-19_68a4f5e56f9343fa8ead6ce36098ec9c_elex_remcos_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:3456
  • C:\Users\Admin\AppData\Local\Temp\2026-07-19_68a4f5e56f9343fa8ead6ce36098ec9c_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-07-19_68a4f5e56f9343fa8ead6ce36098ec9c_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:5584

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DynamicComponents.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\DynamicComponents.exe
        • Size 968KB
        • SHA256 4e937527d3a87968c653409baf5e4675b84c0ac03284020080552441a09a4ca9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Acrofx32AdobeCollabSync.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\Acrofx32AdobeCollabSync.exe
        • Size 1.5MB
        • SHA256 d2a0bfa4a9e63b819164cbe13caee976fa43f86497d70e361be0dd5c5719c04f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        LogTransport2DirectInk.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\LogTransport2DirectInk.exe
        • Size 950KB
        • SHA256 6d4ed6c1006f4e234ebcaa4fbe5fb45e01cbf6e1140be436859415441d4714a7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SystemWindows.exe
        • Path C:\Program Files (x86)\Windows NT\TableTextService\en-US\SystemWindows.exe
        • Size 947KB
        • SHA256 208eaee1642f01124cf8b4d3b77b18b499e0627f582dd6c0d096f0f0166f571f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OperatingWindows.exe
        • Path C:\Windows\IME\OperatingWindows.exe
        • Size 945KB
        • SHA256 cd8b258f72089aa4a98c32f12305fd0d6cc501eaaa99cd37e96d28be1e1b36ba
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msstylesmsstyles10.0.26100.1.exe
        • Path C:\Windows\Resources\Themes\aero\de-DE\msstylesmsstyles10.0.26100.1.exe
        • Size 947KB
        • SHA256 da0baaf019dd8ca6d1c8d368ddcd4d6143f50535732281c3a8454d88a39341e6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download