Overview

overview

7

Static

static

3

2026-07-30...op.exe

windows10-2004-x64

7

2026-07-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    151s
  • max time network
    143s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 03:07

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_a047f819c16b286c97d51de5c6fa3cdb_elex_stealc_stop.exe
  • Size 17.6MB
  • Sample260730-dmk44a1zat
  • SHA256 f52315dc89c2137b71a9f6380cf61feefb6f258dd6cb94a486fe27a433a73ea1
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomware

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Windows directory 43 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_a047f819c16b286c97d51de5c6fa3cdb_elex_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_a047f819c16b286c97d51de5c6fa3cdb_elex_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:1264
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{79714B3A-0736-4800-9C41-4C886BEB205A}\LifeTest Ver6.1 20170802.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-07-30_a047f819c16b286c97d51de5c6fa3cdb_elex_stealc_stop.exe"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:4088
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3340
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:5496
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding CE7143CA30566E3E887964B2DFAD0D86
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5104
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:2980

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        e5a3cec.rbs
        • Path C:\Config.Msi\e5a3cec.rbs
        • Size 676KB
        • SHA256 1e810679b8146d90c627da7ac49b92a7b460fe2598131c4232adf835d1017a38
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Life.exe
        • Path C:\LIFE\Life.exe
        • Size 22.2MB
        • SHA256 333f6888ebdfbc0939179febcd738db31f1801053f22f56e899f1cb610c8cd58
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _is8BB1.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\_is8BB1.tmp
        • Size 1KB
        • SHA256 f364ed70c2ae41be4f264da94c2c91f8f77bf10295bb149110ba608a23d01570
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        0x0409.ini
        • Path C:\Users\Admin\AppData\Local\Temp\{268696F9-DB73-4781-9924-CF5379AA21D5}\0x0409.ini
        • Size 21KB
        • SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        _ISMSIDEL.INI
        • Path C:\Users\Admin\AppData\Local\Temp\{268696F9-DB73-4781-9924-CF5379AA21D5}\_ISMSIDEL.INI
        • Size 20B
        • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
        • MD5 SHA1 SHA512
        Submit Download

        ~8BAE.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\~8BAE.tmp
        • Size 5KB
        • SHA256 d9efa422524c2ae6a99d8e28fe24145f0d85e98f22a027ef0c779f3ae666223c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MSI4354.tmp
        • Path C:\Windows\Installer\MSI4354.tmp
        • Size 101KB
        • SHA256 d5b4d013d30c9443b72b7fe2222d4fb5958d2591d59394f86ce2c0c337dd8911
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        e5a3ceb.msi
        • Path C:\Windows\Installer\e5a3ceb.msi
        • Size 17.2MB
        • SHA256 7778314d1c0ae5471d5106a2a34469edcea9dcaaf2735d419edac61a304d4baf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NewShortcut3_815FE3A5FA6F4A7E86B2F8E22413E08A.exe
        • Path C:\Windows\Installer\{5D2F8156-3E33-4208-874E-5D144B9DAB1F}\NewShortcut3_815FE3A5FA6F4A7E86B2F8E22413E08A.exe
        • Size 40KB
        • SHA256 0278dbed7173580dfcdffd8acc4d6a6a822c131bd711be69fb2258ca33a90b1c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        metadata-2
        • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
        • Size 26.1MB
        • SHA256 34584bb9efd1ed31d4a11b134bf51834a5eaa1eac134730e20bc0180b0a91b64
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        {1fbc6012-9e5f-4cc7-a2c9-83cb4175649d}_OnDiskSnapshotProp
        • Path \??\Volume{c61fa831-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{1fbc6012-9e5f-4cc7-a2c9-83cb4175649d}_OnDiskSnapshotProp
        • Size 6KB
        • SHA256 a6d7cb3473b7e53cbd59b760636a07926ec2a8cd1a92d187dfd5e00866b439e0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download