5201d2f1a9de5fb4fdf2415db9b6e84f5c2b73da88af73a9bd18163eed9530fd

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_58355eaf4e94a169058447ffcd624749_elex_stop.exe
Size 1.6MB
Sample260810-c3bd6ahn9z
SHA256 5201d2f1a9de5fb4fdf2415db9b6e84f5c2b73da88af73a9bd18163eed9530fd
MD5 58355eaf4e94a169058447ffcd624749
SHA1 02bec011141973d404f4d10e088f468e25e155d7
SHA512 9bf572d87e97f13c9ec02aba5b1a247ad48db63fa8d185bf839177dca753c5aee119628725d0d66532b6318ef9a0c2c3ccc943315af723a1350c198ffa28bb61
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrHYA+wJGaafDd70iTWCv:46F0eMpAAYEhpC4hwENDd79WCv
TLSH
T1B6759D10E783C0B5F82314F1454FE7BAA530AE2544318DABF7C8EF15BA72AA26539716
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1064	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_58355eaf4e94a169058447ffcd624749_elex_stop.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
1064	original_temp.exe
1064	original_temp.exe
1064	original_temp.exe
1064	original_temp.exe
1064	original_temp.exe
1064	original_temp.exe
1064	original_temp.exe
1064	original_temp.exe
1064	original_temp.exe
1064	original_temp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3040	AdobeARM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 1064	5960	2026-08-10_58355eaf4e94a169058447ffcd624749_elex_stop.exe	90
PID 1064 wrote to memory of 3040	1064	original_temp.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-10_58355eaf4e94a169058447ffcd624749_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_58355eaf4e94a169058447ffcd624749_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1064
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

OneDrive.exe

Path C:\Users\Admin\AppData\Local\Microsoft\OneDrive\OneDrive.exe
Size 3.5MB
SHA256 069b70c8159d0e3a4200e9f9b01aaf431737e2b094c831f0581942c59228bd08
MD5 94f0e82e3695035619440d670acf26b3
SHA1 6642d4569ac00bb29b9f63d9fa6d573f7832e163
SHA512 32816cd4c0ab7a0d56ff5627a1e46ebd2c664cf8889b07ebc3efc6eedfe0c78292c9a6f9cb436304d188f750afc84d4cdb75e6f34f623c9349b4d452ae747e9a
SSDEEP 24576:z7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOmqMHRs47WXnueVulvspdbl:Q6F0eMpAAYEhp7qe37WXnu6ulvKdfLMq
TLSH
T16FF539E2BE92F0B1E4D20CB1390BE6BED5237C348C238997B783F72D6573651562A116
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 7e0f7cf7080cbd8e6d8baa830792be3a042caa5dcd248ab95d682572cfd8a12e
MD5 1c60bb343cdee8b321f3da686de16883
SHA1 0eee01a6a38beb0c906083ddbe46d998d1f694b1
SHA512 d9273b3cf30cf7c1d82d67886168713d1951da555d1895ecf15586d3550167e0a936dcc5f7731fd201a9898297c070df8e77b28e811b03708d9a6da5c90fa1ca
TLSH
T17EC0128209FE90294F2780CAA50B2FB010D13333D6818E6132102B06A9A0C02CEDB828
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCX3727.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCX3727.tmp
Size 1.1MB
SHA256 09ea33ae644dc9d42dae89b516f67b111083edeb4086aa6d319a927126673770
MD5 97f54dd35e727c9832c00b4b9a5de0da
SHA1 c529db27f49896a22839eb202c4b1019ed73878f
SHA512 c8079990b6fc1d60ab69998e69df56fcc56f2f6fa645a48e03951b7e69dbf50023a8bf9530fd813f9bd421308d5eaaa8c250ca5372cc18eea01fbd6bfbd04c92
SSDEEP 24576:67VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOfHYA+woG:p6F0eMpAAYEhpS4hwD
TLSH
T1F6455C54E783C4F5FD2314F1444BE7FBA5309E1A80318D6BFBC8EE11BAB2D622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 415KB
SHA256 42a785896b64d822bc87b65aa7b10029ceefa9f96d5b110d2474a346315f626a
MD5 2fc2b76462c2e445e35f1300b2c6f2dd
SHA1 6e7343e3d8276bbb914efbf126095d42a9bb3303
SHA512 9211b0e7d38ad6e2e4dfcb30c12cc4c2622b04e2a15620eaf1cc226904f9fe9b322cfdfedb97802828f74a35566dd218aacc163e0ec1fa4df2038c72b6b9aa7d
SSDEEP 6144:dc90CA0QawtUrqNUk0BX3h3KuemLqd7C1io0edeuVkHbHnHPAqYvr6yRI7:Oa0wIk0BX3RKuemGd70ioGuVWW6oI7
TLSH
T11D947C1077D0C036F1B329368ABFD724542DB8715F6886CFA388166E5EB06E1EA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 1a051490f597432e8a121519a184192bd71b77b1b5bf5b3971f13ce3c9d4ea31
MD5 b23bb259c8cbaa6c583319a0011b81f1
SHA1 d8e6ff4adbae30848e411ec31a72f51365a93123
SHA512 8412fadb59a243979f4cb0fe68f46b06a2db78673917395eda7857ce8667c9b32fbfcf0ad7e80ce76fbc302fad849c0df859cf7d1124eec07db05fb1022342c4
SSDEEP 24576:b7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOrHYA+wJG:46F0eMpAAYEhpC4hwE
TLSH
T101455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 f8b4446028b083bd51b48ad25e1d4e7f0c06d19e6b0e8669fa74910dda9d611b
MD5 bafd0cdce31e13c2bd34f4f279588a5b
SHA1 93fd8207c52755a7494d295ce1651fd10f6db326
SHA512 b9df0c562d06a16ab43c0367a2440400d3720b0f9fd6cb6ea13fd53e06b70fed5f6e59e73683018bd86bd596daba84a8f5d67a1a06a2ba3bec5374c2542877d1
SSDEEP 24576:T7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOjHYA+wWa:w6F0eMpAAYEhpG4hwx
TLSH
T1DB455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.2MB
SHA256 c497262575f683a51bcd17afc1c8d37ca8885bfb58b1e6900284e5f5c36d7934
MD5 080ae5cb932d2f01b2e3b71791649450
SHA1 4cdb9a14ef0bd8f187c184521e09d8922885d0e4
SHA512 da53c3602da95bdbe80a99d76e86e165451b0d94b724ad61a0829ea1b5835942fe52c282b0001b57ac21cb6f663c62562318920cd29498e77c199aed2997d1b6
SSDEEP 24576:77VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOaHYA+wqN:Y6F0eMpAAYEhpD4hwa
TLSH
T10D455C54E783C4F5FD2314F1444BEBFBA5309E1940318D6BFBC8EE11BAB2E622529616
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5960-152-0x0000000000400000-0x0000000000533000-memory.dmp

Download