1a0f3e29ae4159680f569cf0fc39190ccfdf9a1bc6cdd03e198322cee9ae1d9a

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_b382e15cd0d1459b513dfd5fd1de5d75_elex_stop.exe
Size 1.8MB
Sample260810-chj6kade62
SHA256 1a0f3e29ae4159680f569cf0fc39190ccfdf9a1bc6cdd03e198322cee9ae1d9a
MD5 b382e15cd0d1459b513dfd5fd1de5d75
SHA1 73d12da5dca89fc1e77e1259e40a81e5f6e11e6e
SHA512 f5a77a90624d36a5624f55b27ab35029a2888437378bf66e3e5a336f296a50fcad02e72aeaa156248b7238cabdb38b5223f636428ef62b0eea3072c6e7a7111b
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIS1YA+wn7aafDd70iTWCb:36F0eMpAAYEhpBS+hw7NDd79WCb
TLSH
T151957CD0FF82B0B5F86308F1350FE7BE95236D254422899BE78BFF2579729916539202
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery spyware stealer

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3244	original_temp.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_b382e15cd0d1459b513dfd5fd1de5d75_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	original_temp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AdobeARM.exe

Suspicious behavior: EnumeratesProcesses 10 IoCs

pid	Process
3244	original_temp.exe
3244	original_temp.exe
3244	original_temp.exe
3244	original_temp.exe
3244	original_temp.exe
3244	original_temp.exe
3244	original_temp.exe
3244	original_temp.exe
3244	original_temp.exe
3244	original_temp.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
712	AdobeARM.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 916 wrote to memory of 3244	916	2026-08-10_b382e15cd0d1459b513dfd5fd1de5d75_elex_stop.exe	89
PID 3244 wrote to memory of 712	3244	original_temp.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-10_b382e15cd0d1459b513dfd5fd1de5d75_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_b382e15cd0d1459b513dfd5fd1de5d75_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:916
- C:\Users\Admin\AppData\Local\Temp\original_temp.exe
  "C:\Users\Admin\AppData\Local\Temp\original_temp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:3244
- - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
    "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AdobeARM.log

Path C:\Users\Admin\AppData\Local\Temp\AdobeARM.log
Size 178B
SHA256 87e494e21fe01cff5a7458c9a69ab98504f1b0a25e77b00df766bd72254b8779
MD5 55567d419afa3aa6fa1503832315ed8f
SHA1 fac4085f34d29b8c6b7768213519a0acd386399d
SHA512 70e5605afd5f87f007ddf3a4bac3efd40ce7a025eb47129bf1ba71fd1270b086bd0ce4fccd768dd4f146f6f2443c0561ba7a8db201f4d1cd29aeb29f743267da
TLSH
T1EDC012020BBE90194F2680CAA50A2FB210D13953DA415E3523343B06E9A0C02CE5BD18
MD5 SHA1 SHA512 TLSH

Submit Download

ArmUI.ini

Path C:\Users\Admin\AppData\Local\Temp\ArmUI.ini
Size 251KB
SHA256 b4d4dcd9594d372d7c0c975d80ef5802c88502895ed4b8a26ca62e225f2f18b0
MD5 864c22fb9a1c0670edf01c6ed3e4fbe4
SHA1 bf636f8baed998a1eb4531af9e833e6d3d8df129
SHA512 ff23616ee67d51daa2640ae638f59a8d331930a29b98c2d1bd3b236d2f651f243f9bae38d58515714886cfbb13b9be721d490aad4f2d10cbba74d7701ab34e09
SSDEEP 3072:wT4DJAvCXkQqSmSgojgTaDuK1+4xKtaU/QX5Pm9vR549QHmYPCjTMNro0Jnxu4Fn:xvUzH5
TLSH
T1B144E44363FC1209F6F37B41EEB852A44B77BDA5AA3EC15D1184015E08F5A90DA72BB3
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

RCXE0E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\RCXE0E4.tmp
Size 1.4MB
SHA256 22605d15aca791e54767281c86a9c0fc2fb7315b23a25a86f82cf60e3733f0fc
MD5 429c0b4b37fb0518275b05c977443712
SHA1 17663fb7ec4508799a1c591c841eb4b043102002
SHA512 a83a6f449b59d25b842ec6d958fb09fc2ad835e9c9fb2fb643aaf549cdd204d1e76403da7b950a18a16161c09dcba95f50e2c69fb9df123231fe33908b510b91
SSDEEP 24576:M7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOTS1YA+wO7:P6F0eMpAAYEhpOS+hwY
TLSH
T16D655CD5EF43B4F5F85308F1350BE7BEA5236E2984228D27FA8BFF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

original_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\original_temp.exe
Size 415KB
SHA256 42a785896b64d822bc87b65aa7b10029ceefa9f96d5b110d2474a346315f626a
MD5 2fc2b76462c2e445e35f1300b2c6f2dd
SHA1 6e7343e3d8276bbb914efbf126095d42a9bb3303
SHA512 9211b0e7d38ad6e2e4dfcb30c12cc4c2622b04e2a15620eaf1cc226904f9fe9b322cfdfedb97802828f74a35566dd218aacc163e0ec1fa4df2038c72b6b9aa7d
SSDEEP 6144:dc90CA0QawtUrqNUk0BX3h3KuemLqd7C1io0edeuVkHbHnHPAqYvr6yRI7:Oa0wIk0BX3RKuemGd70ioGuVWW6oI7
TLSH
T11D947C1077D0C036F1B329368ABFD724542DB8715F6886CFA388166E5EB06E1EA3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 53cd93bcecbd33b125bcb63397778dfe3e0f2e23ea386fb236222c5367a31706
MD5 3f1e1117e5e9cbb25b522fb1f11e2978
SHA1 76486d357762d33a54d9f8a7c037824edc89d0b7
SHA512 4a91f95d0b8cd83f5d83a4cfc9b4fd1abe2f9ec4ebc4a3b44b46768f8c93275c109f5919f45b61442ed4fa708aaf6f97914121eca74decf2688d610e10db3fe3
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOIS1YA+wn7:36F0eMpAAYEhpBS+hw7
TLSH
T197656CD5EF43B4F5F85308F1310BE7BEA5236E2984228D67FA8BFF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 e3664a3a5611826f1c7baee93e6277b3d78f3a929070bb112eccfc3db36db225
MD5 e9402283aa66cd3bc5caf9e12b0d9b76
SHA1 aafa5f41049871f940d5a1bd83554450ef2df64d
SHA512 867e33221774c59b685787c9048840db79e802de55ab6f6130dcf9d283100ef0c2bfa05e3488ce18cafa5f707883b93aa3d659e6962f022879626bfd1cb33b92
SSDEEP 24576:07VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOtS1YA+wo3:36F0eMpAAYEhpQS+hwK
TLSH
T166656CD5EF43B4F5F85308F1310BE7BEA5236E2984228D67FA8BFF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 ac4ca3de1a0523b7690ccd58bd8d8fc1eb9580f84e870c79bf7001601d10733d
MD5 f0052f425c9aa412b0953836ef7a4d96
SHA1 fa8bfae365cd8b5fd2cb36fb66e3e3e9939d4fe8
SHA512 91afe47c9e05280a983b108d59607700398e8ff4feebf7c5e0f8e88b8228054eefcd3955498822ec1f1a5cd8f2ce2b843e23ae2819d9e4561bd08a8fec9f72a3
SSDEEP 24576:A7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsO0S1YA+weV:76F0eMpAAYEhphS+hwm
TLSH
T1EC656CD5EF83B4F5F85308F1310BE7BEA5236E2584228D67FA8BFF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

virus_temp.exe

Path C:\Users\Admin\AppData\Local\Temp\virus_temp.exe
Size 1.4MB
SHA256 15a58443f989958890e2eb3de765383830aace56f724dbd433081d6666306915
MD5 42dd060a5967276b5bcee3a02e66601c
SHA1 37348fde3c36e6d1e813130865dab0ba5acd02c2
SHA512 90ce2d45061a3725064832f923ea527756d242d4cae195e8fefd403f165fe7518ec341eb4cd2cfa1acc06d35c0d4f4793da93dccf9258d902d8779b73633d6f3
SSDEEP 24576:g7VKG/tF5T+0jM6UJfz1ET+/pFCkAAYWDhjKeGBXsOJS1YA+w9X:b6F0eMpAAYEhpIS+hwB
TLSH
T1F8656CD5EF83B4F5F85308F1310BE7BEA5236E2584228D67FA8BFF11B5729522529102
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/916-153-0x0000000000400000-0x000000000057A000-memory.dmp

Download