Overview

overview

7

Static

static

3

2026-07-28...op.exe

windows10-2004-x64

7

2026-07-28...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/07/2026, 04:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-28_7e4051fb70eb68829403d738a63cc738_elex_stealc_stop.exe
  • Size 36.2MB
  • Sample260728-fa8qqsbj6s
  • SHA256 f9f383e4e015beff89c95dda7ab658b5de9ea803039e8c16a479555853bf095b
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
defense_evasiondiscoveryspywaretrojan

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 16 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
    defense_evasionspywaretrojan
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-28_7e4051fb70eb68829403d738a63cc738_elex_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-28_7e4051fb70eb68829403d738a63cc738_elex_stealc_stop.exe"
    1⤵
    • Loads dropped DLL
    • Enumerates connected drives
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1084
    • C:\Users\Admin\AppData\Local\Temp\{A8E75B08-86F2-4DAB-8163-DC998821CED8}\ISBEW64.exe
      C:\Users\Admin\AppData\Local\Temp\{A8E75B08-86F2-4DAB-8163-DC998821CED8}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D5567D07-6EA5-4A0B-A2D7-C1BC5769D3C0}
      2⤵
      • Executes dropped EXE
      PID:5692
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2736
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 5E720F877966BDFD0C10D616B9FA8015 C
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:1528

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        MSI388C.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI388C.tmp
        • Size 57KB
        • SHA256 e886026008391aec859db251fff4c9a55a45c50c227e4063d336835073f25745
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI52CC.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\MSI52CC.tmp
        • Size 122KB
        • SHA256 1af4d7548834c516d02c04e13f446dfb528e01f3352eabe8a6c7528e4caffeca
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is2C0D.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is2C0D.tmp
        • Size 1KB
        • SHA256 0b25ea318a212d6a2379f8f461366670bc54051f88d66ab3ba08ee2ff91c543d
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0x0410.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{5CE24D78-EC0E-44F1-A3A9-2222B7710D2C}\0x0410.ini
        • Size 24KB
        • SHA256 2970bb63e5bc3de4c693de313d715c0c5f93bd35e18cdaec56954034cc7653a6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISSetup.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{5CE24D78-EC0E-44F1-A3A9-2222B7710D2C}\ISSetup.dll
        • Size 1.9MB
        • SHA256 3e8ddc16ba4cfe4a9aa99fa918aff5024f74e6f1fcb3dbf021f48ef0794c8139
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISBEW64.exe
        • Path C:\Users\Admin\AppData\Local\Temp\{A8E75B08-86F2-4DAB-8163-DC998821CED8}\ISBEW64.exe
        • Size 104KB
        • SHA256 4935372daa99f6c10033accf0cd6403b6f7061477500c1eb65d7ca2dedbcbfd8
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ISRT.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A8E75B08-86F2-4DAB-8163-DC998821CED8}\ISRT.dll
        • Size 258KB
        • SHA256 f82e52e2a5176c01312f95b300b66ab1d2a0b0bc2556500c8f42a61390cc49cd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isres_0x0410.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A8E75B08-86F2-4DAB-8163-DC998821CED8}\_isres_0x0410.dll
        • Size 333KB
        • SHA256 d3b0cb73abeb4a9d4583591a435406f48a7d798784d9975a6e396538fa54083d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _isuser_0x0410.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A8E75B08-86F2-4DAB-8163-DC998821CED8}\_isuser_0x0410.dll
        • Size 376KB
        • SHA256 f17fa1fd06eea9515ddc5b4366c070bcc5a208341ea218fdd0187ab722098bea
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        uednload.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A8E75B08-86F2-4DAB-8163-DC998821CED8}\uednload.dll
        • Size 90KB
        • SHA256 36a0dd2f7df2e736814681e221c206b278868f53dd243765114691e9637baf95
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wiseremoval.dll
        • Path C:\Users\Admin\AppData\Local\Temp\{A8E75B08-86F2-4DAB-8163-DC998821CED8}\wiseremoval.dll
        • Size 75KB
        • SHA256 9f1f29eff51d188182c85b4717c16309100927e1522e9138fbd16d2d3ff5f8a5
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ~2BFA.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~2BFA.tmp
        • Size 5KB
        • SHA256 1117f197da07045a0e0b3ac790975403bff4efc3fa79801d2f3800eb09b43b6b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/1084-60-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1084-130-0x00000000078B0000-0x0000000007956000-memory.dmp
        Download

        memory/1084-127-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1084-131-0x00000000078B0000-0x0000000007956000-memory.dmp
        Download

        memory/1084-61-0x00000000025C0000-0x00000000025C2000-memory.dmp
        Download

        memory/1084-148-0x0000000007B00000-0x0000000007B17000-memory.dmp
        Download

        memory/1084-152-0x0000000007B00000-0x0000000007B1B000-memory.dmp
        Download

        memory/1084-153-0x0000000010000000-0x00000000101B4000-memory.dmp
        Download

        memory/1084-154-0x00000000078B0000-0x0000000007956000-memory.dmp
        Download

        memory/1084-163-0x0000000000B10000-0x0000000000B27000-memory.dmp
        Download

        memory/1084-165-0x00000000078B0000-0x0000000007956000-memory.dmp
        Download