Analysis

  • max time kernel
    149s
  • max time network
    159s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20260130-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
  • submitted
    06/02/2026, 21:53

General

  • Target
    2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
  • Size 68KB
  • Sample260206-1rtclaev2a
  • SHA256 3eb88d5f959b72dcaf147b7311c806015d42147ddbee4ca97ef24fe9a07287cd
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Nitro

    A ransomware that demands Discord nitro gift codes to decrypt files.

  • Nitro family
  • Renames multiple (80) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 6 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4104
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:1176
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4448
  • C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:1884

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        ApproveUndo.wvx

        • Path C:\Users\Admin\Desktop\ApproveUndo.wvx
        • Size 143KB
        • SHA256 cc36913c0c0d3f0d516e7acc986094f717379e9b5c9317df67c4db38acc8d071
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ApproveUndo.wvx.givemenitro

        • Path C:\Users\Admin\Desktop\ApproveUndo.wvx.givemenitro
        • Size 144KB
        • SHA256 248419cd52c32a573c085f0d34f206560e908d660c723703f4aa57a093260a95
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BlockFormat.ram

        • Path C:\Users\Admin\Desktop\BlockFormat.ram
        • Size 136KB
        • SHA256 45b153edc2d15266db53794b17a4ae6f70f55ad97aea4a562861cc08e29d76db
        • MD5 SHA1 SHA512 SSDEEP TLSH

        BlockFormat.ram.givemenitro

        • Path C:\Users\Admin\Desktop\BlockFormat.ram.givemenitro
        • Size 137KB
        • SHA256 d8a00812df66573e1baf31fc3e883603e2b13edab8bda11df593aed0c9cbc014
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CheckpointClear.xlsx

        • Path C:\Users\Admin\Desktop\CheckpointClear.xlsx
        • Size 12KB
        • SHA256 71bb4164b89f1a30300d7b2063ecb6f98128db5dc3c07703909690077654f007
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CheckpointClear.xlsx.givemenitro

        • Path C:\Users\Admin\Desktop\CheckpointClear.xlsx.givemenitro
        • Size 12KB
        • SHA256 45ee4ebc7d02628d36db0ffa77281781b08b71ef365127439345dcbb2b6095e7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CheckpointSet.crw

        • Path C:\Users\Admin\Desktop\CheckpointSet.crw
        • Size 122KB
        • SHA256 5e6117cd8be0149076fe99f290810bb36ab8e69a0c868507c39d0a472ed4359a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CheckpointSet.crw.givemenitro

        • Path C:\Users\Admin\Desktop\CheckpointSet.crw.givemenitro
        • Size 123KB
        • SHA256 2eec5e09215b27c4de1fe141043656013eae83a751304e6400b37d96669972fc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompareRepair.ram

        • Path C:\Users\Admin\Desktop\CompareRepair.ram
        • Size 179KB
        • SHA256 31be96ffc9a9a164e425d69b918e279eda54972ac26c174716a04f0bf53c97af
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CompareRepair.ram.givemenitro

        • Path C:\Users\Admin\Desktop\CompareRepair.ram.givemenitro
        • Size 179KB
        • SHA256 18b942ce1116f07e745e3d73655e99e9802f91c9efecea8a99b6dcf920e51c08
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertRepair.css

        • Path C:\Users\Admin\Desktop\ConvertRepair.css
        • Size 151KB
        • SHA256 935b7e78e926da5964d91858e19c65d6c09351b5386b3bc06e4418a370776d8d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertRepair.css.givemenitro

        • Path C:\Users\Admin\Desktop\ConvertRepair.css.givemenitro
        • Size 151KB
        • SHA256 3acaa521d8050d75a6240bbe2c8c17c714da37ce7b90f23603becd9039c90f77
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToUndo.vsw

        • Path C:\Users\Admin\Desktop\ConvertToUndo.vsw
        • Size 221KB
        • SHA256 4807536088e2714c21da8cfe80d2ac16552f2a39d2254ea7b44edd709fccd2ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConvertToUndo.vsw.givemenitro

        • Path C:\Users\Admin\Desktop\ConvertToUndo.vsw.givemenitro
        • Size 221KB
        • SHA256 b4b0250d23dd96afdc77e69d09a603890828189f72e1345eed04f42855771434
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DismountUse.m3u

        • Path C:\Users\Admin\Desktop\DismountUse.m3u
        • Size 186KB
        • SHA256 7eb061a594ab0cd650509de3ed2e718d8ca8056af39da7879bc2db4604be7caf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        DismountUse.m3u.givemenitro

        • Path C:\Users\Admin\Desktop\DismountUse.m3u.givemenitro
        • Size 186KB
        • SHA256 d33d683fb407254705c3ea64e452fa7e0fc4278b450652c81d24c1728ebbd725
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EditInstall.docx

        • Path C:\Users\Admin\Desktop\EditInstall.docx
        • Size 12KB
        • SHA256 3edca786c90ba42d30883544e2664c2706522b277daa475681590fc81382c54e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EditInstall.docx.givemenitro

        • Path C:\Users\Admin\Desktop\EditInstall.docx.givemenitro
        • Size 13KB
        • SHA256 4006a17292bd6e602320384daa953a463fb8bf40efd5dc167be0cf997fdd5388
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FindRedo.xls

        • Path C:\Users\Admin\Desktop\FindRedo.xls
        • Size 270KB
        • SHA256 4ed2493f5a9a7dfde2d437a9ba686147cb6d779ede6bdf700801fb463cab4c56
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FindRedo.xls.givemenitro

        • Path C:\Users\Admin\Desktop\FindRedo.xls.givemenitro
        • Size 270KB
        • SHA256 46054aa9674117b17daca72cada4a7922b9db89028aa5a4e2c91f09d371daed8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JoinApprove.avi

        • Path C:\Users\Admin\Desktop\JoinApprove.avi
        • Size 129KB
        • SHA256 3f6c850dc1cd24df61b75438f6521008f7275fe6b5926df083ca2d6f1dcb239d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        JoinApprove.avi.givemenitro

        • Path C:\Users\Admin\Desktop\JoinApprove.avi.givemenitro
        • Size 130KB
        • SHA256 acfb307f737c824411c83796838919541c8e4f81dfac5027957d8ca5cea9dc5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LockMerge.mpv2

        • Path C:\Users\Admin\Desktop\LockMerge.mpv2
        • Size 235KB
        • SHA256 27f12bbf7f26a8d4e0fc46e3b5681c3bc5191efc0771a23645b75bb3de906d1e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LockMerge.mpv2.givemenitro

        • Path C:\Users\Admin\Desktop\LockMerge.mpv2.givemenitro
        • Size 235KB
        • SHA256 b8c72ffed9ffb0812897133a0ac54c873347619f9c83ae62fef71a79113e154a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft Edge.lnk

        • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
        • Size 2KB
        • SHA256 28247612c186c9e487e59d06694b279efb1d70f0cd264b46d2f878695f2ec0e4
        • MD5 SHA1 SHA512 TLSH

        Microsoft Edge.lnk.givemenitro

        • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk.givemenitro
        • Size 2KB
        • SHA256 7a23c105e452259ed2bcbf244ce4aa3c976b1bb46b02bce7f95bc32285bf0665
        • MD5 SHA1 SHA512 TLSH

        OptimizeGroup.rm

        • Path C:\Users\Admin\Desktop\OptimizeGroup.rm
        • Size 193KB
        • SHA256 adb8b7e2ad0a6d5ad3d7f1b97dc34c14f3499a574d57ac64c8153c6a1b6a72ca
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OptimizeGroup.rm.givemenitro

        • Path C:\Users\Admin\Desktop\OptimizeGroup.rm.givemenitro
        • Size 193KB
        • SHA256 7bfac6e46b4229764bbc410dc1a491a55170919c1d7e120f2ebb271ad5e7a9c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PingDebug.xlsx

        • Path C:\Users\Admin\Desktop\PingDebug.xlsx
        • Size 9KB
        • SHA256 5015b545be09506bb89bdb95a5efda9082c099c1aad25550379442b7d8e7d6c4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PingDebug.xlsx.givemenitro

        • Path C:\Users\Admin\Desktop\PingDebug.xlsx.givemenitro
        • Size 10KB
        • SHA256 ce544b6f725160612f32ddb647021569044ec34f61210777a4d238d952043a3c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PublishConvertFrom.ico

        • Path C:\Users\Admin\Desktop\PublishConvertFrom.ico
        • Size 228KB
        • SHA256 71756247221a25adba1ecff0a42d289ae4aeb9af075bcb3992f677defba67fbe
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PublishConvertFrom.ico.givemenitro

        • Path C:\Users\Admin\Desktop\PublishConvertFrom.ico.givemenitro
        • Size 228KB
        • SHA256 d18d06f6e67cfff267e2f5c877828aebe30ac70803fe365912e8531970e9b438
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PushFind.bmp

        • Path C:\Users\Admin\Desktop\PushFind.bmp
        • Size 158KB
        • SHA256 b620a123482f8e23bea1fd7994da89d57161725ead6d5ce5e67bcc158bf71015
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PushFind.bmp.givemenitro

        • Path C:\Users\Admin\Desktop\PushFind.bmp.givemenitro
        • Size 158KB
        • SHA256 beef9a2c8bbba52390ac3331c81bc15d6dce00b31c4088af94ff12f5f42ae0a2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PushMount.mpeg2

        • Path C:\Users\Admin\Desktop\PushMount.mpeg2
        • Size 115KB
        • SHA256 444615c25cb25751f8ba20a43534f7e2f52bfb47cfc4c968404026b52691f2bb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PushMount.mpeg2.givemenitro

        • Path C:\Users\Admin\Desktop\PushMount.mpeg2.givemenitro
        • Size 116KB
        • SHA256 b4abe89118bcd19c89af235f5e67a26ac11fe16d90d547328b57916a0a23662d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RegisterConnect.hta

        • Path C:\Users\Admin\Desktop\RegisterConnect.hta
        • Size 108KB
        • SHA256 a374d12b645b6a57123abcd74110771b61324317cc400fda882f2cf9c52995cb
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RegisterConnect.hta.givemenitro

        • Path C:\Users\Admin\Desktop\RegisterConnect.hta.givemenitro
        • Size 109KB
        • SHA256 586c7170b690c910fb3a89102eef39a7b84236a68cbddc884836bf8ad3191103
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SelectRequest.mp3

        • Path C:\Users\Admin\Desktop\SelectRequest.mp3
        • Size 249KB
        • SHA256 04cdcb813b27a7d5709d1c196ab5b53d90be1249332de8b8320b6d064a7aaa5f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SelectRequest.mp3.givemenitro

        • Path C:\Users\Admin\Desktop\SelectRequest.mp3.givemenitro
        • Size 249KB
        • SHA256 38fe7e8a8d6ad13d5859ad9b4f613d6d5450ed7f4effe8542c32deb7707da74a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SetRestart.xml

        • Path C:\Users\Admin\Desktop\SetRestart.xml
        • Size 94KB
        • SHA256 b9a09e66e87c3bf505f4b9bf9539eec73e1d0e34b61af62d8253534f7988155c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SetRestart.xml.givemenitro

        • Path C:\Users\Admin\Desktop\SetRestart.xml.givemenitro
        • Size 95KB
        • SHA256 c3d8fd61a70f184ba0a28c52f3b7a217a10cdd7438327530f51683062cb71b78
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ShowGroup.wma

        • Path C:\Users\Admin\Desktop\ShowGroup.wma
        • Size 172KB
        • SHA256 392306db037378b14ffe344d01afd7d1635760cf9da12d86dff65ae78bb09eae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ShowGroup.wma.givemenitro

        • Path C:\Users\Admin\Desktop\ShowGroup.wma.givemenitro
        • Size 172KB
        • SHA256 b209a46d731382584450c494abe856a40e2ac8178b65a914ae69acfa763caec6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SplitEnter.vbe

        • Path C:\Users\Admin\Desktop\SplitEnter.vbe
        • Size 200KB
        • SHA256 9026f24b9658be6008a20f8aa50a32d8401b339cf4db2f137290d176b8054285
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SplitEnter.vbe.givemenitro

        • Path C:\Users\Admin\Desktop\SplitEnter.vbe.givemenitro
        • Size 200KB
        • SHA256 5a108d770876bd6d2ebc80cde122f0db127a97ec90dfac4c5de3d30f819180ed
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StopCheckpoint.ppt

        • Path C:\Users\Admin\Desktop\StopCheckpoint.ppt
        • Size 263KB
        • SHA256 53a5ef393adc5a4b1eea1ba341024010a54cd5baa289544f5ef41c5a3325a2f4
        • MD5 SHA1 SHA512 SSDEEP TLSH

        StopCheckpoint.ppt.givemenitro

        • Path C:\Users\Admin\Desktop\StopCheckpoint.ppt.givemenitro
        • Size 263KB
        • SHA256 08231ba48aa890bca08fa0930d4959fe89e58c4a931ac053a72086eebdbd4458
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SubmitFormat.mp3

        • Path C:\Users\Admin\Desktop\SubmitFormat.mp3
        • Size 165KB
        • SHA256 a7794603aef9a527715f3f3addf31035dc3d59ccc9b165f20ce852d31339a2dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SubmitFormat.mp3.givemenitro

        • Path C:\Users\Admin\Desktop\SubmitFormat.mp3.givemenitro
        • Size 165KB
        • SHA256 b9b37eab59ac33d9f09cd76efdcf23b9d4402a6643eb4bf170177bb08171d37e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SwitchMove.ppsx

        • Path C:\Users\Admin\Desktop\SwitchMove.ppsx
        • Size 372KB
        • SHA256 9aca13993a1e80b754662ceea7125aae3644f01ed8c6351c522a90b1b3ee11ab
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SwitchMove.ppsx.givemenitro

        • Path C:\Users\Admin\Desktop\SwitchMove.ppsx.givemenitro
        • Size 372KB
        • SHA256 76f76598dafc7d18890ad081e18f377cf2f132429bfb6aa1cdaed1b3fc6090ba
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SwitchTest.easmx

        • Path C:\Users\Admin\Desktop\SwitchTest.easmx
        • Size 242KB
        • SHA256 0c3e86a0a2d8ab057a84dce457d4238ec693b26ba87f974b85d8ca41cefcde0f
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SwitchTest.easmx.givemenitro

        • Path C:\Users\Admin\Desktop\SwitchTest.easmx.givemenitro
        • Size 242KB
        • SHA256 3ac3dae6cb1741dd55aee872fcb3a32e85b45bd46fc114bc6b509cdb854869ae
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TraceStart.tiff

        • Path C:\Users\Admin\Desktop\TraceStart.tiff
        • Size 207KB
        • SHA256 8fa5542dd2a42a29ec8df7960283dd9a9255d492614ff6c0829df3193355d15e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        TraceStart.tiff.givemenitro

        • Path C:\Users\Admin\Desktop\TraceStart.tiff.givemenitro
        • Size 207KB
        • SHA256 71d7c331d3e6046165a5d90a8d2f3c490932f8125f835c799cf2157d7d261be9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UninstallPublish.pdf

        • Path C:\Users\Admin\Desktop\UninstallPublish.pdf
        • Size 101KB
        • SHA256 ce236efb4bb25510fe84d5bb49db51dff83eb361f78223cc5d3796f32f30fcc2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UninstallPublish.pdf.givemenitro

        • Path C:\Users\Admin\Desktop\UninstallPublish.pdf.givemenitro
        • Size 102KB
        • SHA256 68a6e6b3d66c2dc328e96793a53a2ac68ff036e05aa61748df769e0710e5f6f9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UpdateConfirm.zip

        • Path C:\Users\Admin\Desktop\UpdateConfirm.zip
        • Size 214KB
        • SHA256 7f78c31602833a302352de1846eec909f0dc1de0cfb96f79b13666515c0ac74d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UpdateConfirm.zip.givemenitro

        • Path C:\Users\Admin\Desktop\UpdateConfirm.zip.givemenitro
        • Size 214KB
        • SHA256 759d82148f722aa54f76f6825683ef43841fb68917f88e27b99619b4bdd0eff5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WriteDebug.7z

        • Path C:\Users\Admin\Desktop\WriteDebug.7z
        • Size 256KB
        • SHA256 e18fbb51ed6a778d5f4c78f931bcd724ae6bba2af79f231156612e4eee92e566
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WriteDebug.7z.givemenitro

        • Path C:\Users\Admin\Desktop\WriteDebug.7z.givemenitro
        • Size 256KB
        • SHA256 1ab56294d0995528cd0d7bd86f9bd969c20d3d4697ea0a12b22bbb82012dba91
        • MD5 SHA1 SHA512 SSDEEP TLSH

        desktop.ini

        • Path C:\Users\Admin\Desktop\desktop.ini
        • Size 282B
        • SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
        • MD5 SHA1 SHA512 TLSH

        desktop.ini.givemenitro

        • Path C:\Users\Admin\Desktop\desktop.ini.givemenitro
        • Size 564B
        • SHA256 4fdfadf3655ddceb39f91a2ac760176693c21b03af7cc00215930beab2496b09
        • MD5 SHA1 SHA512 TLSH

        memory/4104-2-0x0000000005200000-0x0000000005292000-memory.dmp

        memory/4104-90-0x0000000005390000-0x00000000053A0000-memory.dmp

        memory/4104-89-0x0000000005390000-0x00000000053A0000-memory.dmp

        memory/4104-88-0x0000000006EA0000-0x0000000006EAA000-memory.dmp

        memory/4104-87-0x0000000005390000-0x00000000053A0000-memory.dmp

        memory/4104-3-0x0000000005390000-0x00000000053A0000-memory.dmp

        memory/4104-0-0x0000000000920000-0x0000000000938000-memory.dmp

        memory/4104-1-0x0000000005710000-0x0000000005CB4000-memory.dmp