Overview

overview

6

Static

static

3

2026-11-01...ee.exe

windows10-2004-x64

6

2026-11-01...ee.exe

windows11-ltsc_2024-x64

6

Analysis

  • max time kernel
    132s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 09:41

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_c188ee1845cf46c7302d5a189e263926_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
  • Size 1.3MB
  • Sample261102-lpap5sgx2s
  • SHA256 1e69ab2370cf0aa9e2148c2bbea8c157d2938231aea203f5ecfa27b75ab090ad
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 6 IoCs
  • Drops file in Program Files directory 27 IoCs
  • Drops file in Windows directory 40 IoCs
  • Reads the TCP/IP host and domain name from the registry 1 TTPs 4 IoCs

    The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

    discovery
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 56 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_c188ee1845cf46c7302d5a189e263926_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_c188ee1845cf46c7302d5a189e263926_elex_remcos_smoke-loader_stealc_stop_tofsee.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • Reads the TCP/IP host and domain name from the registry
    • System Location Discovery: System Language Discovery
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:360
  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_c188ee1845cf46c7302d5a189e263926_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    C:\Users\Admin\AppData\Local\Temp\2026-11-01_c188ee1845cf46c7302d5a189e263926_elex_remcos_smoke-loader_stealc_stop_tofsee.exe
    1⤵
    • Drops file in System32 directory
    • Reads the TCP/IP host and domain name from the registry
    • Checks processor information in registry
    • Suspicious behavior: EnumeratesProcesses
    PID:5540

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        DirectXd3dcompiler43.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\AcroCEF\DirectXd3dcompiler43.exe
        • Size 1.3MB
        • SHA256 39446a7739f54c2276139429ada40f51738445bddd659c81150f97ddf9872f70
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ProjectionDynamic.exe
        • Path C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\ProjectionDynamic.exe
        • Size 1.9MB
        • SHA256 c881c1ae6687557f0157369f09530ad280b90490582d0beef02fc130f203173d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GoogleUpdater.exe
        • Path C:\Program Files (x86)\Google\GoogleUpdater\141.0.7340.0\GoogleUpdater.exe
        • Size 1.9MB
        • SHA256 6dabd0160b6b34de9638caa7f790d758a3f10029579f2b9eb048e7add563dbf1
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ieinstalIEXPLORE.exe
        • Path C:\Program Files (x86)\Internet Explorer\ja-JP\ieinstalIEXPLORE.exe
        • Size 1.3MB
        • SHA256 9e4c8582fab7c9067f0504c62f8b12af113a715be62e328714cab4856524e7ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MicrosoftMicrosoft.exe
        • Path C:\Program Files (x86)\WindowsPowerShell\Modules\PackageManagement\1.0.0.1\MicrosoftMicrosoft.exe
        • Size 1.3MB
        • SHA256 9ff6b93f5251761cf3faa2d9382edb0ead7e88cea973e3e2ea288d1f51cff33f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ComponentWindows.exe
        • Path C:\Windows\ImmersiveControlPanel\ComponentWindows.exe
        • Size 1.3MB
        • SHA256 1e69ab2370cf0aa9e2148c2bbea8c157d2938231aea203f5ecfa27b75ab090ad
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        resourcesresources344.exe
        • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.Build.resources\v4.0_4.0.0.0_es_b03f5f7f11d50a3a\resourcesresources344.exe
        • Size 1.3MB
        • SHA256 ad01c8426f7ab5be37cfff96be20c100297bba3faca8bf6769c1a703a274ba7c
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PowerShellSystem.exe
        • Path C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\PowerShellSystem.exe
        • Size 1.3MB
        • SHA256 343034f4b6b13994090a53cb57aae46aaf451a1713cb7ffb9ed7caa9f1a1c667
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download