Overview

overview

10

Static

static

5

2026-09-28...op.exe

windows10-2004-x64

10

2026-09-28...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    28/09/2026, 18:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-28_0690b8258cdb4e5534f2e71dd9b8ba54_agent-tesla_backswap_elex_stop.exe
  • Size 1.2MB
  • Sample260928-w63gla1zft
  • SHA256 95466645360c7ab4b88fcc0fdcdce384eeb7c1734b4e89ea63972951c551b31f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
    persistence
  • UPX dump on OEP (original entry point) 4 IoCs
  • Drops file in Drivers directory 1 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies visibility of existing users in the login screen 1 TTPs 4 IoCs

    A user account was hidden or made visible on the Windows login screen through a registry modification.

    defense_evasion
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 9 IoCs
    persistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 8 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 64 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 4 IoCs
    stealer
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-28_0690b8258cdb4e5534f2e71dd9b8ba54_agent-tesla_backswap_elex_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_0690b8258cdb4e5534f2e71dd9b8ba54_agent-tesla_backswap_elex_stop.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of existing users in the login screen
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Windows\SysWOW64\lssas.exe
      C:\Windows\SysWOW64\lssas.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:1408
  • C:\ProgramData\lsass.exe
    C:\ProgramData\lsass.exe
    1⤵
    • Modifies WinLogon for persistence
    • Drops file in Drivers directory
    • Executes dropped EXE
    • Modifies visibility of existing users in the login screen
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3676
  • C:\ProgramData\csrss.exe
    C:\ProgramData\csrss.exe
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Modifies visibility of existing users in the login screen
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1452
  • C:\ProgramData\services.exe
    C:\ProgramData\services.exe
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Modifies visibility of existing users in the login screen
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:652

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Replication Through Removable Media

        1
        T1091

        Execution

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Privilege Escalation

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Users

        1
        T1564.002

        Modify Registry

        5
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Replication Through Removable Media

        1
        T1091

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        aut6E86.tmp
        • Path C:\Users\Admin\AppData\Local\Temp\aut6E86.tmp
        • Size 96KB
        • SHA256 984abb09c288fc638bfc278690f3c695954b8b9e7c70006da86b26c0eb90591b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        winlogon.exe
        • Path C:\Windows\SysWOW64\1036\winlogon.exe
        • Size 1.2MB
        • SHA256 95466645360c7ab4b88fcc0fdcdce384eeb7c1734b4e89ea63972951c551b31f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KeyLogger.dll
        • Path C:\Windows\SysWOW64\KeyLogger.dll
        • Size 5KB
        • SHA256 834466ff5057bfcd7f610eaed6b7319ab899eca210a7b8117d9a9cfded992416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 314B
        • SHA256 0861e0ff2d454efd1d741d9342e58c5a8acfc232b8227a9682e4ba42c74302f4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 314B
        • SHA256 17504b0be6bca2d632875e41232608dd753ce704c484a7750921bedac49f329f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 314B
        • SHA256 b709f4f8f813b0fec27e2365f73786ec2f43117c0f20d0ac040a56cb902ab791
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 314B
        • SHA256 7b4596a9491ac1471a869254a4477868e1a2b453d8ef52fc9e681603ca0f90e0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 314B
        • SHA256 84f892e7044f66acdeef8f3bf8216b3dbc884e9c93a28dccb9b659d3a2119998
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 314B
        • SHA256 4bbcb38d440df350f5cd14064d62594e45dda31015824e5088a9c84814efff3e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 314B
        • SHA256 e5057716c5804ce6eda1bee3580fc754c3be0533c4343c5007608f971286dc79
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 170B
        • SHA256 e3ee35fb0829a90e94664651d125b0376008e907f970c02d1f0718b8d2f30332
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 314B
        • SHA256 466252b0090628b6b99e64568d6d3cffdd5cbb41a9b230d4d287c22668f6041e
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        lssas.exe
        • Path C:\Windows\SysWOW64\lssas.exe
        • Size 7KB
        • SHA256 0ae5cdc799ea65174bd65278c6c7cb91b69aecad11619adb8c5ac85e328dcc8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        autorun.inf
        • Path F:\\autorun.inf
        • Size 403B
        • SHA256 5486aab7a25405da35c7e7b5c5a66cad15b9cd25c52759ac8c931019cf995387
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        autorun.inf
        • Path F:\\autorun.inf
        • Size 127B
        • SHA256 4a2f2e9650550d9853383fe154a9ccfe98921d34b813c3f2951a031556376cb0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        autorun.inf
        • Path F:\\autorun.inf
        • Size 139B
        • SHA256 d6121b62656d034b5ce31b05a874ca4c000dd2839a419ac62e2f446865164bde
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        autorun.inf
        • Path F:\\autorun.inf
        • Size 127B
        • SHA256 6df7dd6101d06d612a5cf92f46c2978cc7c15d9dc0b6581a8222f66ce09a32a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/1408-268-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/1408-41-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/1428-0-0x0000000000400000-0x00000000004AF000-memory.dmp
        Download