29e1bc8a90ac90b799ee1860138799d824900f8fbc4283bba8aaf48134da64b1

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_d8b2d25ee431478e798d323b1315e50c_elex_stop.exe
Size 1.6MB
Sample260722-26rb8aam2y
SHA256 29e1bc8a90ac90b799ee1860138799d824900f8fbc4283bba8aaf48134da64b1
MD5 d8b2d25ee431478e798d323b1315e50c
SHA1 8450273db23b3c7ce5b79c4db837cd428e0efdf7
SHA512 f8899827d3bdd7128c96f2b77f2fc85098ac12a77a380a163a4094c188ec8524504223d59412239c12e6021b30d19dc52fff5d594808b7a3f22803cdcbacbd90
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6HYA+weTaafDd70iTWCB:A6F0eMpAAYEhpb4hwANDd79WCB
TLSH
T157759D10E783C0B5F82314F1454FE7BAA530AE2544318DABF7C8EF15BA72AA27539716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4636	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_d8b2d25ee431478e798d323b1315e50c_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4636	original_temp.exe
4636	original_temp.exe
4636	original_temp.exe
4636	original_temp.exe
4636	original_temp.exe
4636	original_temp.exe
4636	original_temp.exe
4636	original_temp.exe
4636	original_temp.exe
4636	original_temp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
6136	AdobeARM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5364 wrote to memory of 4636	5364	2026-07-22_d8b2d25ee431478e798d323b1315e50c_elex_stop.exe	90
PID 4636 wrote to memory of 6136	4636	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-22_d8b2d25ee431478e798d323b1315e50c_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_d8b2d25ee431478e798d323b1315e50c_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5364
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4636
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:6136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 f4f39809720e08d9dc20ae3a5b1c63045b6d14860c1aa2b238e392a0251962c8
MD5 dea609509b9bfc1b45666afec4cc7a13
SHA1 741d29c12c44e02880049add41d46ea5634274c3
SHA512 89a16963d567163a6be2b2c04f0e6db68b01c1d80f87b1348897dfc8972970885d38950145b56b72991d53da1af45717e1645c7688e082d8f5b6228fcaee7fa2
TLSH
T1C5C0122291BF500A07263080BA2B3FD298C2711F86618A2032246B46B22049B2F6FB1C
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3D41.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3D41.tmp
Size 1.1MB
SHA256 46dd8ef10db36925496920a65ae224831ac5e3cc9dfe2e9941e244edfa8412de
MD5 9b8556fee37cca0f160907da4738b4c0
SHA1 a9eaeae000272d4207a0ec02afc43c7571717064
SHA512 30906fbfc09a395f0bd025e2f4082f7ee674ab969f25b15b323fa640ba213f53f5d425b66e5923bfb6b201795be78c14b6c489cb23f50e6ace6e3f269b0286b3
SSDEEP 24576:u7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOdHYA+wTO:F6F0eMpAAYEhpE4hwC
TLSH
T1C1455C54E783C4F5FD2314F1444BE7FBA5309E1A80318D6BFBC8EE11BAB2D622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 415KB
SHA256 42a785896b64d822bc87b65aa7b10029ceefa9f96d5b110d2474a346315f626a
MD5 2fc2b76462c2e445e35f1300b2c6f2dd
SHA1 6e7343e3d8276bbb914efbf126095d42a9bb3303
SHA512 9211b0e7d38ad6e2e4dfcb30c12cc4c2622b04e2a15620eaf1cc226904f9fe9b322cfdfedb97802828f74a35566dd218aacc163e0ec1fa4df2038c72b6b9aa7d
SSDEEP 6144:dc90CA0QawtUrqNUk0BX3h3KuemLqd7C1io0edeuVkHbHnHPAqYvr6yRI7:Oa0wIk0BX3RKuemGd70ioGuVWW6oI7
TLSH
T11D947C1077D0C036F1B329368ABFD724542DB8715F6886CFA388166E5EB06E1EA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 1acfe1aadb02497e01056956276f38fda2aaa408f02e9609bb9a04d255a0bf5d
MD5 0505f4093fd76bcc1ddf05ee9314590b
SHA1 256aade2d5631a73724c7166bf7eb51f010012d2
SHA512 ed86e4aa0a3d1966e724009cb634fb6736a8ab2c6121ec50e864fb11c0c56ed87514698e39ddce6603fa2b464baf1d14d874ec318a34f1903ab036b632c0dcee
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO6HYA+weT:A6F0eMpAAYEhpb4hwA
TLSH
T12C455B54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 06d5be87767348bba007ad5e434d6f7652c51428d5693853215f18afbddcd8ba
MD5 fcdcd39f65c690992d2d4979686e4878
SHA1 5b5bef1a8558fadb10a936a3a337e043008b96fc
SHA512 617147e07a7b6584281aa319879eef8daaa926fa2a039e7f787df08ee1b3dc6f472e2e0be0d62eb31e5fb4048fcc0339184489438ebe1e369d7c21b2666e21c7
SSDEEP 24576:D7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsORHYA+wVP:A6F0eMpAAYEhpI4hwh
TLSH
T11D455B54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 014bf12b2f3e28e47f73deccfc42c07957dade070d323e62034c4dab23d24baf
MD5 f13c079461efe136d1c30e99d7408419
SHA1 ff8e9ba4169e7c524eb3d1c6dc699d7d1264d3c3
SHA512 fdcb7817e1c90e2b55792f8a5587aa3e176031272d10a654a1d33deae6b90dafb8767a2dfec2b5f9a0e4fd0def1c8c91f72085df6a73fad479ae29c1a6e8edcc
SSDEEP 24576:77VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOmHYA+wCZ:Y6F0eMpAAYEhpr4hwy
TLSH
T14B455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 609b405df458b441d0a8ccdee2420848fef38bdd63cd5275a46e0b3b675b811e
MD5 d3cfc911ef9d9208307b101b63555bfa
SHA1 e5032a4ab2e0fd56d8f43a14a3f2e8c9064a0ec8
SHA512 dfc098b3aa4287e7cda035cf29b4f9114c8f6c681018b72c4033146a44c1a4c88448c3cebf0d7346bfb8c14d3a8b66169b8c04b544c1420527f3c069c789b290
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOgHYA+wTO:w6F0eMpAAYEhpx4hwC
TLSH
T1F3455B54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5364-155-0x0000000000400000-0x0000000000533000-memory.dmp

Download