Overview

overview

7

Static

static

3

2026-07-30...op.exe

windows10-2004-x64

7

2026-07-30...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    141s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260709-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    30/07/2026, 03:17

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-07-30_7b94293998fc7e62de111b5f8bca0cdf_elex_stealc_stop.exe
  • Size 16.5MB
  • Sample260730-dtcfjacj2z
  • SHA256 31ba8e329820c9b85d6ec6e99a87ed2734517e85ecb6d5dd108bb764d12c4022
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryransomware

Malware Config

Signatures

  • Loads dropped DLL 1 IoCs
  • Enumerates connected drives 3 TTPs 46 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 32 IoCs
  • Drops file in Windows directory 43 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 5 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs
  • Uses Volume Shadow Copy service COM API

    The Volume Shadow Copy service is used to manage backups/snapshots.

    ransomware

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-07-30_7b94293998fc7e62de111b5f8bca0cdf_elex_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_7b94293998fc7e62de111b5f8bca0cdf_elex_stealc_stop.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious use of WriteProcessMemory
    PID:3328
    • C:\Windows\SysWOW64\MSIEXEC.EXE
      MSIEXEC.EXE /i "C:\Users\Admin\AppData\Local\Downloaded Installations\{BD297324-1E7E-4C5F-A717-4F6559F75CD8}\LifeTest Ver5.1 20170802.msi" SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="2026-07-30_7b94293998fc7e62de111b5f8bca0cdf_elex_stealc_stop.exe"
      2⤵
      • Enumerates connected drives
      • System Location Discovery: System Language Discovery
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SetWindowsHookEx
      PID:2596
  • C:\Windows\system32\msiexec.exe
    C:\Windows\system32\msiexec.exe /V
    1⤵
    • Enumerates connected drives
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies data under HKEY_USERS
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:2436
    • C:\Windows\system32\srtasks.exe
      C:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:2
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:1608
    • C:\Windows\syswow64\MsiExec.exe
      C:\Windows\syswow64\MsiExec.exe -Embedding 69B4CC6BF32CA3E784D0AC6B30ABEF53
      2⤵
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of SetWindowsHookEx
      PID:5912
  • C:\Windows\system32\vssvc.exe
    C:\Windows\system32\vssvc.exe
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious use of AdjustPrivilegeToken
    PID:1560
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k GPSvcGroup
    1⤵
      PID:3632

    Network

          MITRE ATT&CK Enterprise v16

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          e5a01f6.rbs
          • Path C:\Config.Msi\e5a01f6.rbs
          • Size 676KB
          • SHA256 8e2531b5639c29ca926994af6bb35e037cd7c63cfc3301e1c03b82131ab90f47
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          Life.exe
          • Path C:\LIFE\Life.exe
          • Size 18.5MB
          • SHA256 04ac815db79b85dcd857427eb2b64095cc75fdbda406d5b6de73fc678619cb3e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _is4C18.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\_is4C18.tmp
          • Size 1KB
          • SHA256 d2a510ceccd44b081ebcd4e335f4d663154c0bfdca65a25168be4c2ef2c8f6ab
          • MD5 SHA1 SHA512 TLSH
          Submit Download

          0x0409.ini
          • Path C:\Users\Admin\AppData\Local\Temp\{A347A501-FA0D-4CB8-97A3-2E0A733EA68B}\0x0409.ini
          • Size 21KB
          • SHA256 e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          _ISMSIDEL.INI
          • Path C:\Users\Admin\AppData\Local\Temp\{A347A501-FA0D-4CB8-97A3-2E0A733EA68B}\_ISMSIDEL.INI
          • Size 20B
          • SHA256 0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13
          • MD5 SHA1 SHA512
          Submit Download

          ~4C15.tmp
          • Path C:\Users\Admin\AppData\Local\Temp\~4C15.tmp
          • Size 5KB
          • SHA256 2f63c84694f17e0d70e02f8209cb72b67191ff53d823ba936f0133540fb68edc
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          MSIEA7.tmp
          • Path C:\Windows\Installer\MSIEA7.tmp
          • Size 101KB
          • SHA256 d5b4d013d30c9443b72b7fe2222d4fb5958d2591d59394f86ce2c0c337dd8911
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          e5a01f5.msi
          • Path C:\Windows\Installer\e5a01f5.msi
          • Size 16.1MB
          • SHA256 6829635e15b17e80ea06082c6148f2f3501f391de90d2ef9940234c0fd70999e
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          NewShortcut4_649324D161AA43529BAFDD62D45D3D83.exe
          • Path C:\Windows\Installer\{5D2F8156-3E33-4208-874E-5D144B9DAB1F}\NewShortcut4_649324D161AA43529BAFDD62D45D3D83.exe
          • Size 40KB
          • SHA256 0278dbed7173580dfcdffd8acc4d6a6a822c131bd711be69fb2258ca33a90b1c
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          metadata-2
          • Path \??\GLOBALROOT\Device\HarddiskVolumeShadowCopy2\System Volume Information\SPP\metadata-2
          • Size 26.1MB
          • SHA256 aa8807e335d18fd6fe3ddb1a99b1ab69592e1de8a79b64775f75b36b735fd574
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download

          {93fa28a6-093d-4314-95a8-48519de47698}_OnDiskSnapshotProp
          • Path \??\Volume{c4ee2a5b-0000-0000-0000-d08302000000}\System Volume Information\SPP\OnlineMetadataCache\{93fa28a6-093d-4314-95a8-48519de47698}_OnDiskSnapshotProp
          • Size 6KB
          • SHA256 0b9ea341ce5d48f4892b63ea821f73c53fdefb25465a74f8c52d6bf4d9e91b4b
          • MD5 SHA1 SHA512 SSDEEP TLSH
          Submit Download