d2eb0c6e6206286588ad980e5190040a4487164ac2fb410e9353efc1789937ff

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_40e2ef77029cbfe04ee9f49fbfdebbea_elex_stop.exe
Size 1.6MB
Sample260804-jec2eafc94
SHA256 d2eb0c6e6206286588ad980e5190040a4487164ac2fb410e9353efc1789937ff
MD5 40e2ef77029cbfe04ee9f49fbfdebbea
SHA1 7662752730d72191f196c2553163622535939647
SHA512 a3900b241787a0c2e1bee3c1e3fef88ceb37bc942ec0368a3ce32d3119f2a7aac0a4404c4e78d2c5624a2fd730432f4dacde9481a87fa1c7340900a8c8e1adc7
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/WYA+wKEaafDd70iTWCr:j6F0eMpAAYEhpSPhwPNDd79WCr
TLSH
T1DE759D10F783C4B5F82314F1444FE7BA6530AE2544318DABF7C8EF15BAB2AA26539716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4864	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_40e2ef77029cbfe04ee9f49fbfdebbea_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
4864	original_temp.exe
4864	original_temp.exe
4864	original_temp.exe
4864	original_temp.exe
4864	original_temp.exe
4864	original_temp.exe
4864	original_temp.exe
4864	original_temp.exe
4864	original_temp.exe
4864	original_temp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
2744	AdobeARM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2480 wrote to memory of 4864	2480	2026-08-04_40e2ef77029cbfe04ee9f49fbfdebbea_elex_stop.exe	90
PID 4864 wrote to memory of 2744	4864	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_40e2ef77029cbfe04ee9f49fbfdebbea_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_40e2ef77029cbfe04ee9f49fbfdebbea_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2480
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:4864
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:2744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 19e2a25f5f274ce6765cb06bfefec32781248f6a30916d10ca33f406f3cebfa3
MD5 62077a14437e2a7c41b009df0a5ae31e
SHA1 5060ceb911b305b8923527faf612ef8e45ccc5b9
SHA512 ca4b0d7a21fded6c6fccd6fde4bb729ded2498f1d9554ef5c9ebe730b0e1c44a154e44b0241da7df05ef019ca8be1404a1af090570b568b77e0f3965015677ba
SSDEEP 24576:H7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOlqXURs47WXnueVulvspdbl:M6F0eMpAAYEhpUqk37WXnu6ulvKdfLMq
TLSH
T19DF539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 12e34cea29c46bd2c070ed6e82d963f57f040f10f69304d60fcc2af7648dea0f
MD5 6acc160ebf51d58c0def01c30f2add42
SHA1 9f816ce0de1db468b89c705b066179c2b2c9cacc
SHA512 f8534c1dbc8d5942e8f54d1d3b31db327d9bfba758c26861d77687ae1bfc51564c36b3b03ab4cf2aa3849309beddbc1afae952539f0fb6fe3acb7448096f483a
TLSH
T102C0120142BFA4254B36104D95133F5110927311CB49C515B234269774E04160817D1D
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX43F.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX43F.tmp
Size 1.2MB
SHA256 7b4d30654a7277bd4808b66f4358225e69dd571f2b0fef76ab6149c65c94059c
MD5 5e2897440d2b6be46aa390bacb13f269
SHA1 2cfbbe8e902136989cb8db2dac15196d1d5d9ec1
SHA512 4f60e9faef395039ea30f0171cccf85f33bc41ae8789b25f29d12ebf860b09c6a435eb312188b951dcb261f9a061e8a9454ae13523f69749cd990f80ab1fe9f0
SSDEEP 24576:k7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsODWYA+wDE:H6F0eMpAAYEhpyPhwY
TLSH
T14D455C54E783C4F5FD2314F1444FE7FBA5309E1A40318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 415KB
SHA256 42a785896b64d822bc87b65aa7b10029ceefa9f96d5b110d2474a346315f626a
MD5 2fc2b76462c2e445e35f1300b2c6f2dd
SHA1 6e7343e3d8276bbb914efbf126095d42a9bb3303
SHA512 9211b0e7d38ad6e2e4dfcb30c12cc4c2622b04e2a15620eaf1cc226904f9fe9b322cfdfedb97802828f74a35566dd218aacc163e0ec1fa4df2038c72b6b9aa7d
SSDEEP 6144:dc90CA0QawtUrqNUk0BX3h3KuemLqd7C1io0edeuVkHbHnHPAqYvr6yRI7:Oa0wIk0BX3RKuemGd70ioGuVWW6oI7
TLSH
T11D947C1077D0C036F1B329368ABFD724542DB8715F6886CFA388166E5EB06E1EA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 4e9c358440960fb2a4c8724af00e16f180a976cf8f9bff82d049ad39a543891a
MD5 e3bce20b711175057b7bf6c751c62f84
SHA1 b35edf8fff7bb5140c6af526f3722643c2bd9cbb
SHA512 a53650a99425449ff2b9cdb0e8f54c55b1dc7cba5d5dd440ec8f21bb4386df804279825cbe0036f20a03698fc5dac74ba52b4c18f5c94a238cf7e44e972142e7
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/WYA+wKE:j6F0eMpAAYEhpSPhwP
TLSH
T12C455B94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 ceadba920553e7f6dd37b66874bf291e5c271c538b86243d35d693645d816a77
MD5 9ceadcb98782dc31159ca1e2157506f1
SHA1 225053b2dc6747f35b952f0ce122478ef0278cf4
SHA512 87988cdec4b55cd7ca12a5e73aa43a9692789746a2a7eaaa8e0a4c47e11fc9f0a6ce4081ac7ca5a5fe2ad89567c939ffdd632b432d527aba8844d11e2b6c9beb
SSDEEP 24576:c7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOKWYA+wyt:/6F0eMpAAYEhpPPhwS
TLSH
T1D3455B94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 17cc759e0a7dcdf759283edae663ceac0a98dca92497a2014b5320df10007368
MD5 32b5a18e8e39963798e42d10beddc39f
SHA1 037f4604bad3604b58868065990d887947c53496
SHA512 8bc9a220a0b44a59fe969012f99c334f56e58f645cd938f0a79d5de7f8da559472c96202ff277bfa2843111d42f3fef18c4fa16d6c473c43ee70dd90d8ebded4
SSDEEP 24576:o7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO/WYA+wJo:j6F0eMpAAYEhpmPhwe
TLSH
T174455C94E783C4F5FD2314F1444FE7FBA5309E1940318D6BFBC8EE11BAB2A622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2480-155-0x0000000000400000-0x0000000000534000-memory.dmp

Download