Overview

overview

7

Static

static

3

2026-11-01...op.exe

windows10-2004-x64

7

2026-11-01...op.exe

windows11-ltsc_2024-x64

7

Analysis

  • max time kernel
    150s
  • max time network
    126s
  • platform
    windows11-ltsc_2024_x64
  • resource
    win11ltsc2024-20260911-en
  • resource tags

    arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
  • submitted
    02/11/2026, 15:23

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    2026-11-01_8bd5b68cbf5fe69389216cc25de860ba_elex_remcos_stealc_stop.exe
  • Size 1.2MB
  • Sample261102-ssledavtdw
  • SHA256 235e96026dfba323b5f696fc3d6e9c643f51a3c13abff14e6414aa2a64b0b02f
  • MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
discoveryspywarestealerupx

Malware Config

Signatures

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Drops file in System32 directory 20 IoCs
  • UPX packed file 25 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-11-01_8bd5b68cbf5fe69389216cc25de860ba_elex_remcos_stealc_stop.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-11-01_8bd5b68cbf5fe69389216cc25de860ba_elex_remcos_stealc_stop.exe"
    1⤵
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:4412

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        elevation_service.exe
        • Path C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe
        • Size 2.9MB
        • SHA256 c979cb1c383923cafe355b1966df74873133b52e575917e2f14a94121aaa4823
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        maintenanceservice.exe
        • Path C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
        • Size 1017KB
        • SHA256 99a557437f7083a47b009979f1d9b17135e6fed4cfc38e50a83e9452c93fdbfd
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        OSE.EXE
        • Path C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE
        • Size 997KB
        • SHA256 d21464469bd2727458488523ff845301fb4cbd550a828cd0d5bc3a65da013254
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        setup.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Installer\setup.exe
        • Size 186KB
        • SHA256 60caedfa4b83a06a0f36d4daeedec860fff4812bc3d594b5a9c20f209bc6cbc0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        elevation_service.exe
        • Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\elevation_service.exe
        • Size 3.0MB
        • SHA256 47ca71ee1a4285d29fcc035564b44a1dddcca1613986f18c1a415e2a1c0c465f
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        MsSense.exe
        • Path C:\Program Files\Windows Defender Advanced Threat Protection\MsSense.exe
        • Size 1.2MB
        • SHA256 fd2537c51e377e6aa6664cf4801284a7b81beadbe5f0855d2db3e23d92ce1592
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        NisSrv.exe
        • Path C:\Program Files\Windows Defender\NisSrv.exe
        • Size 3.7MB
        • SHA256 6e0de33dca1daf3c5fb52ccf7abc3ed7006fa6d1844a2c1e123b9c494c4924b6
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wmpnetwk.exe
        • Path C:\Program Files\Windows Media Player\wmpnetwk.exe
        • Size 1.6MB
        • SHA256 6a820c262320b5718e7abfb65cc1338ff6e186e1fd1f8d811e1c1bc562d548f4
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        perfhost.exe
        • Path C:\Windows\SysWOW64\perfhost.exe
        • Size 778KB
        • SHA256 d8251e1fa47a867cc681c5a5d49cee8dfe4bf1aaea4c3af3c398f5803ce3bcfe
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AgentService.exe
        • Path C:\Windows\System32\AgentService.exe
        • Size 1.6MB
        • SHA256 e0dc1ef6c1e2cf94bc9e4ed97ddff8ed3f227211f2d162807f291d9be4e55ec9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        AppVClient.exe
        • Path C:\Windows\System32\AppVClient.exe
        • Size 1.5MB
        • SHA256 7c0c10cf1a331218fe71c6ef25154828457572d844178f34e9bde063e1f722a0
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        GameInputSvc.exe
        • Path C:\Windows\System32\GameInputSvc.exe
        • Size 828KB
        • SHA256 75d529063ed5b8089b422b24b1d2b63b42530aa7f1db302df6a174c0538f47ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        Locator.exe
        • Path C:\Windows\System32\Locator.exe
        • Size 792KB
        • SHA256 16675b02f54ef02bdf26df309b893d57342b9b61803369798413b406b50f01ab
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ssh-agent.exe
        • Path C:\Windows\System32\OpenSSH\ssh-agent.exe
        • Size 1.3MB
        • SHA256 d4abafb5fc706246a9355c939b01d12b331b6e81f64cc1ce39dfd2fcad0ba5da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        PerceptionSimulationService.exe
        • Path C:\Windows\System32\PerceptionSimulation\PerceptionSimulationService.exe
        • Size 996KB
        • SHA256 1dd907d8d050b53bc695e5117831797799064b642d942c34d7540e61a452b88a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        ReFsDedupSvc.exe
        • Path C:\Windows\System32\ReFsDedupSvc.exe
        • Size 2.8MB
        • SHA256 9d17d3b53c0960c6ab54c4cc3e80ae6b39023aeb283a4fe72a85915cf990b776
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SearchIndexer.exe
        • Path C:\Windows\System32\SearchIndexer.exe
        • Size 1.6MB
        • SHA256 59cb2c66da202fe9e377921e21aed4ee17f1a21d31b7b13e6e75380d15679521
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SensorDataService.exe
        • Path C:\Windows\System32\SensorDataService.exe
        • Size 1.9MB
        • SHA256 6bbba64d9880548a2ddb8e58999aeb6b8fcb4ee0230e24102c9967ca145fbf5b
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        SgrmBroker.exe
        • Path C:\Windows\System32\Sgrm\SgrmBroker.exe
        • Size 1.1MB
        • SHA256 986331f9bd30210f1b1e7226743bfba3b3c580e28dc80c0d39fa76283abf4336
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        TieringEngineService.exe
        • Path C:\Windows\System32\TieringEngineService.exe
        • Size 1.1MB
        • SHA256 dd2a6ca5eabdfd4ece219f56ea49302572b1d1d4e76d0c1a74ed1c18659170e9
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        VSSVC.exe
        • Path C:\Windows\System32\VSSVC.exe
        • Size 2.1MB
        • SHA256 e8dd991f2d3b7ad5e57cd57e7cd5474b405afcfb920cbcfc2b0e3804934d52ae
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        alg.exe
        • Path C:\Windows\System32\alg.exe
        • Size 944KB
        • SHA256 f1ebb1b3854b181082ecafab03c2541f17631d387239ee732f84c1f4c47e3e3a
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msdtc.exe
        • Path C:\Windows\System32\msdtc.exe
        • Size 928KB
        • SHA256 f1c1243e4bda228f27086544f1bcdc9020a28973ab2ae2a450227266d0d6c021
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        msiexec.exe
        • Path C:\Windows\System32\msiexec.exe
        • Size 936KB
        • SHA256 c77046c86540ccde68cc80fe2095e9e9f7338ab50fe40e24290e6b859f361672
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        snmptrap.exe
        • Path C:\Windows\System32\snmptrap.exe
        • Size 800KB
        • SHA256 f6add4e87483480ebfa3c8f1f6788b4b0058d9c8491f34193f4d10beb1a032da
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        vds.exe
        • Path C:\Windows\System32\vds.exe
        • Size 1.4MB
        • SHA256 fb73d3f2dda15eba2b44ba0a87c36e6cf75053fa5abad2ff3a26e6b50678e4c2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        WmiApSrv.exe
        • Path C:\Windows\System32\wbem\WmiApSrv.exe
        • Size 960KB
        • SHA256 6c269c48116a64b9e8ee4bd627117fda137af95414f748bcb3c0d43960d9d40d
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        wbengine.exe
        • Path C:\Windows\System32\wbengine.exe
        • Size 2.2MB
        • SHA256 8dd8c8a47b0cc5827897abec1a9b8805f1cbdb2065df99a4ca41de0582462cc2
        • MD5 SHA1 SHA512 SSDEEP TLSH
        Submit Download

        memory/4412-13-0x0000000077180000-0x0000000077190000-memory.dmp
        Download

        memory/4412-0-0x00000000026C0000-0x00000000027C9000-memory.dmp
        Download

        memory/4412-14-0x0000000077180000-0x0000000077190000-memory.dmp
        Download

        memory/4412-7-0x0000000000E10000-0x0000000000E95000-memory.dmp
        Download

        memory/4412-1-0x0000000000E10000-0x0000000000E95000-memory.dmp
        Download