Overview

overview

7

Static

static

3

2026-10-22...op.exe

windows10-2004-x64

7

2026-10-22...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260911-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    24/10/2026, 04:28

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-10-22_9319b44cbc6ad061ce7661dafb3796cd_elex_remcos_stealc_stop.exe
  • Size 1.2MB
  • Sample261024-e3w2zaec39
  • SHA256 bb2aa646a38188304b9b6daf94c93c7e43882c86527e5ddd43442eeaa4c413ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 21 IoCs
  • UPX packed file 24 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-10-22_9319b44cbc6ad061ce7661dafb3796cd_elex_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-10-22_9319b44cbc6ad061ce7661dafb3796cd_elex_remcos_stealc_stop.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:5164

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 76ff4791be1c685c9acf16623a7dc74954b19f005d07349604b1090501667ccd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 0f4bac7a82dad842b83d96dfe04b38481bc2c176d8ab54325dbb031a77662ee9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 7489110afb8b2afb0a7490e1ab7ee09e961c3e3ec9a4adb6595e68699a3cf7b4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 6.8MB
        • SHA256 fe26d63682fc7faff728dbd6a36d1a1e81cea6b8c2af9d2fa23c8ab7c3175610
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 2b6caff2ae23a64c7636fe9958ec7381fafb674dbd4af2a84e8fd1d181f58dbc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.7MB
        • SHA256 b9672bbaa7b3b842ae39b15f37194f707e69d295638a837ca59c338d1ba9b790
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 ab21ef848bd136d36fb3c3d868dcf97be2a95f17b4eb287c2b2a3ada7047d845
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.9MB
        • SHA256 02c3c5c263501334ccc125aaf37a99c6c75d0993e2d7b1ce50490b9d2e018c90
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 48f28355ec88f819a24028dfeacee6bd7ac5131bb1acf3e973e7bd0ef1d84259
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        DiagnosticsHub.StandardCollector.Service.exe
        • Path C:\Windows\System32\DiagSvcs\DiagnosticsHub.StandardCollector.Service.exe
        • Size 848KB
        • SHA256 c9e42d04dff271672e07d951e39c16c9d75941b8e8b18c460ecb4a767ade8709
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        FXSSVC.exe
        • Path C:\Windows\System32\FXSSVC.exe
        • Size 1.4MB
        • SHA256 f2db4e7cdc03b4442a2ff223d773b602de56da7fa1e58d40d097241f349dc3f9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 767KB
        • SHA256 1fa989986feb270fa7f1fec2d92ebaf5ebd0621a1563cac95d9a281fdf8e41e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.1MB
        • SHA256 32c8bd14e1c07fc6d454458501091535a743d5cc0400aab4aeb05ab85c81f3ef
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 860KB
        • SHA256 7b9a5db20d0c6be63d154e0f0adf871bcbc8736be8402273eae09dc51f6f6ebf
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 e0853faec9e3458a37616536b563d66e724ee0fc5075fb1666217ff13d15226a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 2d5258dc8080f0ef65ba7b59fa862ee97b5cef7cf1b941da5a050517fb8f2bec
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\SgrmBroker.exe
        • Size 1.0MB
        • SHA256 c24b84fbfc72a665bb0c2bc6f097374eabf676c45e1c86ca09013db23418720a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Spectrum.exe
        • Path C:\Windows\System32\Spectrum.exe
        • Size 1.6MB
        • SHA256 a3975bff32890da64e0496ae98655c49781d470d773c4f8c7728736d17a8c6e4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.0MB
        • SHA256 025db817c09900965b537c66b5a337181361749a63eeb736e419d1c7e32c2dcc
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 9146dc5f46ae853ac56cfa7672c5c0cdf5a85c048b0e7504d98ead90b5272781
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 850KB
        • SHA256 4f138b97b7d64c5d066d417dc41da84200fc893920bafeac36b6c43bd5715494
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 901KB
        • SHA256 faf70782eb03d7636f51f4d8b76003709b812918654906c36228fb59356eb317
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 824KB
        • SHA256 13ab1cf377813021a6f92e7519a653e3f85df5dbd2ffaef59d0bbe3815c089ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 773KB
        • SHA256 3c7b05ca64dcd0168e56035011820d1beb1060877dc6e233d755de7b3b8f0ddd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 486fb80c4988c08b54d7a0159fdbaea8a80eca0b8479b0014c24557d65572ae7
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 962KB
        • SHA256 8f1b4876c0bde2d9b0fb5a8b03d4496f554ff9b9436ff057f2c6ebda443a8440
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.3MB
        • SHA256 82e070267ca92b83559c8a6123e131ca4b8c1f769bc3d4ff79c317e0b9b67934
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/5164-13-0x0000000077AA0000-0x0000000077AB0000-memory.dmp
        Download

        memory/5164-14-0x0000000077AA0000-0x0000000077AB0000-memory.dmp
        Download

        memory/5164-15-0x0000000003530000-0x00000000035B7000-memory.dmp
        Download

        memory/5164-7-0x0000000000E30000-0x0000000000EB5000-memory.dmp
        Download

        memory/5164-0-0x0000000002880000-0x0000000002A1B000-memory.dmp
        Download

        memory/5164-1-0x0000000000E30000-0x0000000000EB5000-memory.dmp
        Download