Overview

overview

10

Static

static

5

2026-09-28...op.exe

windows10-2004-x64

10

2026-09-28...op.exe

windows11-ltsc_2024-x64

10

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    28/09/2026, 18:32

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-09-28_0690b8258cdb4e5534f2e71dd9b8ba54_agent-tesla_backswap_elex_stop.exe
  • Size 1.2MB
  • Sample260928-w63gla1zft
  • SHA256 95466645360c7ab4b88fcc0fdcdce384eeb7c1734b4e89ea63972951c551b31f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
10/10
adwaredefense_evasiondiscoverypersistencespywarestealerupx

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 8 IoCs
    persistence
  • UPX dump on OEP (original entry point) 3 IoCs
  • Executes dropped EXE 4 IoCs
  • Loads dropped DLL 1 IoCs
  • Modifies visibility of existing users in the login screen 1 TTPs 4 IoCs

    A user account was hidden or made visible on the Windows login screen through a registry modification.

    defense_evasion
  • Adds Run key to start application 2 TTPs 12 IoCs
    persistence
  • Enumerates connected drives 3 TTPs 64 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Modifies WinLogon 2 TTPs 9 IoCs
    persistence
  • AutoIT Executable 2 IoCs

    AutoIT scripts compiled to PE executables.

  • Drops autorun.inf file 1 TTPs 8 IoCs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in System32 directory 12 IoCs
  • UPX packed file 3 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 8 IoCs
  • Drops file in Windows directory 64 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Reads the TCP/IP host and domain name from the registry 1 TTPs 8 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Modifies Internet Explorer settings 1 TTPs 8 IoCs
    adwarespyware
  • Modifies Internet Explorer start page 1 TTPs 4 IoCs
    stealer
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of FindShellTrayWindow 13 IoCs
  • Suspicious use of SendNotifyMessage 13 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-09-28_0690b8258cdb4e5534f2e71dd9b8ba54_agent-tesla_backswap_elex_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-09-28_0690b8258cdb4e5534f2e71dd9b8ba54_agent-tesla_backswap_elex_stop.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Modifies visibility of existing users in the login screen
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:3652
    • C:\Windows\SysWOW64\lssas.exe
      C:\Windows\SysWOW64\lssas.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • System Location Discovery: System Language Discovery
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      PID:2952
  • C:\ProgramData\lsass.exe
    C:\ProgramData\lsass.exe
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Modifies visibility of existing users in the login screen
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2388
  • C:\ProgramData\services.exe
    C:\ProgramData\services.exe
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Modifies visibility of existing users in the login screen
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2940
  • C:\ProgramData\csrss.exe
    C:\ProgramData\csrss.exe
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Modifies visibility of existing users in the login screen
    • Adds Run key to start application
    • Enumerates connected drives
    • Modifies WinLogon
    • Drops autorun.inf file
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Modifies Internet Explorer settings
    • Modifies Internet Explorer start page
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:3720

Network

        MITRE ATT&CK Enterprise v16

        Reconnaissance

        Resource Development

        Initial Access

        Replication Through Removable Media

        1
        T1091

        Execution

        Persistence

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Privilege Escalation

        Boot or Logon Autostart Execution

        3
        T1547

        Registry Run Keys / Startup Folder

        1
        T1547.001

        Winlogon Helper DLL

        2
        T1547.004

        Defense Evasion

        Hide Artifacts

        1
        T1564

        Hidden Users

        1
        T1564.002

        Modify Registry

        5
        T1112

        Credential Access

        Discovery

        Peripheral Device Discovery

        1
        T1120

        Query Registry

        1
        T1012

        System Information Discovery

        2
        T1082

        System Location Discovery

        1
        T1614

        System Language Discovery

        1
        T1614.001

        System Network Configuration Discovery

        1
        T1016

        Lateral Movement

        Replication Through Removable Media

        1
        T1091

        Collection

        Command and Control

        Exfiltration

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        lsass.exe
        • Path C:\ProgramData\lsass.exe
        • Size 1.2MB
        • SHA256 95466645360c7ab4b88fcc0fdcdce384eeb7c1734b4e89ea63972951c551b31f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        KeyLogger.dll
        • Path C:\Windows\SysWOW64\KeyLogger.dll
        • Size 5KB
        • SHA256 834466ff5057bfcd7f610eaed6b7319ab899eca210a7b8117d9a9cfded992416
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 e090e552fbc8603993c570c21298d066712dae78d75327cc6656b860cabf154a
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 fe46338d9dc3fb61b4729a243073cb6c9225a922105213eb3c5477290b0f1b3c
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 38b819399cedd4abc10f62b83eac880b9d64874b836a507c0cca481a9d129b21
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 3e8bca715d249f1510d35131e67b58b0d2d7f96af44536e2a6ccf41d5cd6f0cb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 4181bbe7b754fd77f7a6e2a0fdff1bbed670776f6eff299bc5f6ee84e9a210eb
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 b1eece87472e6579eddc5db7f8a33349bd57884ce13d486a7f0a3bf33044ab41
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 114B
        • SHA256 2624b7ce7869f49637855faca543633a5b8601eefdfbe1f01970abc8aaac07a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 479e64190b036d7fbaf5eabbac442871c57f032f7570553474a4d3aea50732a7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 1559e1ec487cb3138babe3c01722dfc0e88dedabdc8298b155e66a11a6270237
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 e2ab79543ce16817a4c71dddcbbdde1f753342dcf4641ea127f2d4c37ba5a23f
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 313B
        • SHA256 932f7c7323632d3b2d027a86dea3d54329f4adc7b403d6d9d4f7d64e3fcb8bab
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        Nt.cobra
        • Path C:\Windows\SysWOW64\Nt.cobra
        • Size 114B
        • SHA256 9b99bce87172db2a80cb7030df91a09360926c7dd3480ddb0ad4f93c010443f7
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        lssas.exe
        • Path C:\Windows\SysWOW64\lssas.exe
        • Size 7KB
        • SHA256 0ae5cdc799ea65174bd65278c6c7cb91b69aecad11619adb8c5ac85e328dcc8f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        autorun.inf
        • Path F:\\autorun.inf
        • Size 403B
        • SHA256 5486aab7a25405da35c7e7b5c5a66cad15b9cd25c52759ac8c931019cf995387
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        autorun.inf
        • Path F:\\autorun.inf
        • Size 127B
        • SHA256 4a2f2e9650550d9853383fe154a9ccfe98921d34b813c3f2951a031556376cb0
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        autorun.inf
        • Path F:\\autorun.inf
        • Size 139B
        • SHA256 d6121b62656d034b5ce31b05a874ca4c000dd2839a419ac62e2f446865164bde
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        autorun.inf
        • Path F:\autorun.inf
        • Size 127B
        • SHA256 6df7dd6101d06d612a5cf92f46c2978cc7c15d9dc0b6581a8222f66ce09a32a4
        • MD5 SHA1 SHA512 TLSH
        Submit Download

        memory/2952-121-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/2952-21-0x0000000000400000-0x0000000000409000-memory.dmp
        Download

        memory/3652-0-0x0000000000400000-0x00000000004AF000-memory.dmp
        Download