Analysis

  • max time kernel
    149s
  • max time network
    100s
  • platform
    windows11-21h2_x64
  • resource
    win11-20260130-en
  • resource tags

    arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
  • submitted
    06/02/2026, 21:53

General

  • Target
    2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
  • Size 68KB
  • Sample260206-1rtclaev2a
  • SHA256 3eb88d5f959b72dcaf147b7311c806015d42147ddbee4ca97ef24fe9a07287cd
  • MD5 SHA1 SHA512 SSDEEP TLSH

Malware Config

Signatures

  • Nitro

    A ransomware that demands Discord nitro gift codes to decrypt files.

  • Nitro family
  • Renames multiple (101) files with added filename extension

    This suggests ransomware activity of encrypting all the files on the system.

  • Reads user/profile data of web browsers 3 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 6 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Sets desktop wallpaper using registry 2 TTPs 1 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Sets desktop wallpaper using registry
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:5080
    • C:\Windows\SysWOW64\cmd.exe
      "cmd.exe"
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4180
      • C:\Windows\SysWOW64\Wbem\WMIC.exe
        wmic csproduct get uuid
        3⤵
        • System Location Discovery: System Language Discovery
        • Suspicious use of AdjustPrivilegeToken
        PID:4884
  • C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-02-06_7037cb659af1afd83e3ff9f9e15a5095_elex_nitro.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3688

Network

        MITRE ATT&CK Enterprise v16

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        AddRedo.eprtx

        • Path C:\Users\Admin\Desktop\AddRedo.eprtx
        • Size 297KB
        • SHA256 a512f54ff4f7f01bb0d83e1ff254ce39b3c88172f212b10276bb4dbdfa8b7463
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AddRedo.eprtx.givemenitro

        • Path C:\Users\Admin\Desktop\AddRedo.eprtx.givemenitro
        • Size 298KB
        • SHA256 3b1ce4b4063d5af59b4817083434b92619dc61418a5e19cdade30fa5bcab9052
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ApproveMerge.potx

        • Path C:\Users\Admin\Desktop\ApproveMerge.potx
        • Size 454KB
        • SHA256 464953c6eede45eed50d166a0644a8c32afd84e73fb258a12bd08c93452368b9
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ApproveMerge.potx.givemenitro

        • Path C:\Users\Admin\Desktop\ApproveMerge.potx.givemenitro
        • Size 454KB
        • SHA256 f9da08aa392ad037b5cf1b1de7525c5b480b4def603886a3d2da4b9274eb1b02
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AssertSubmit.emz

        • Path C:\Users\Admin\Desktop\AssertSubmit.emz
        • Size 517KB
        • SHA256 26ef157f35a4395cf201d027c77f885b14edb4ccbda23dd202c01b5c40ade3a8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        AssertSubmit.emz.givemenitro

        • Path C:\Users\Admin\Desktop\AssertSubmit.emz.givemenitro
        • Size 517KB
        • SHA256 afd6f6d8dae2f9dc77de3e86090c436d490cac27c6f8bab968e1f820c84ef419
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CheckpointRequest.M2TS

        • Path C:\Users\Admin\Desktop\CheckpointRequest.M2TS
        • Size 438KB
        • SHA256 75294f42f965441f693fd53aa818ab9128fb2316954a5ef6fee020a9bb8a163c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CheckpointRequest.M2TS.givemenitro

        • Path C:\Users\Admin\Desktop\CheckpointRequest.M2TS.givemenitro
        • Size 439KB
        • SHA256 ab8eb6622a28994347c7839c48149d75668a4de89fb762673c1897388a2f8b87
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConfirmCheckpoint.clr

        • Path C:\Users\Admin\Desktop\ConfirmCheckpoint.clr
        • Size 282KB
        • SHA256 e685af5420f4ade53c70924e6c9b6deb4c6c8df098fa4ac268b047c771609cfc
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConfirmCheckpoint.clr.givemenitro

        • Path C:\Users\Admin\Desktop\ConfirmCheckpoint.clr.givemenitro
        • Size 282KB
        • SHA256 0cc8b21e72e95af524a4a5931a4030b5cf9d5172e55578badfce1491a6add21e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConnectSend.xlsx

        • Path C:\Users\Admin\Desktop\ConnectSend.xlsx
        • Size 10KB
        • SHA256 ff9701e8675505e65c3e6d547a324c876bfeb00178cd89f141a9be522207740d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ConnectSend.xlsx.givemenitro

        • Path C:\Users\Admin\Desktop\ConnectSend.xlsx.givemenitro
        • Size 10KB
        • SHA256 0431a120590e90d3f457edba5824a1cd2a203228e953d6a2da96158b40cf5772
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CopyConnect.ppsm

        • Path C:\Users\Admin\Desktop\CopyConnect.ppsm
        • Size 360KB
        • SHA256 5d79d37254550d3a48265e78a828b8e8a81bfbb029279d63493e21d800003caf
        • MD5 SHA1 SHA512 SSDEEP TLSH

        CopyConnect.ppsm.givemenitro

        • Path C:\Users\Admin\Desktop\CopyConnect.ppsm.givemenitro
        • Size 360KB
        • SHA256 b4205bce526143343c808d2a916b453c31ac871ea8d3a4800cf71f846320d8b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EditInvoke.pps

        • Path C:\Users\Admin\Desktop\EditInvoke.pps
        • Size 235KB
        • SHA256 1fa5cafd9ebe39091005292486ae22da23af515d8e878c3288140ae4436cbdfd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EditInvoke.pps.givemenitro

        • Path C:\Users\Admin\Desktop\EditInvoke.pps.givemenitro
        • Size 235KB
        • SHA256 8a522fa0cf24bfebbec3e1df34b4d1f8a02c64f28670bc4b9041ade2e1b65a93
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EditProtect.dib

        • Path C:\Users\Admin\Desktop\EditProtect.dib
        • Size 501KB
        • SHA256 d997dcd5384c0a5eafd341e0ff544be589115ddcf9a2489555d0f09f6995697d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        EditProtect.dib.givemenitro

        • Path C:\Users\Admin\Desktop\EditProtect.dib.givemenitro
        • Size 501KB
        • SHA256 64f4f7769737e697e906873af5c0b21ea7b52cc14b9f593fde9a3d25f53c29df
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FormatNew.mpa

        • Path C:\Users\Admin\Desktop\FormatNew.mpa
        • Size 313KB
        • SHA256 207a98f9453a6d1097a64ff73a6925bd7e8afa8fce40fdace4b93fe203c3bc50
        • MD5 SHA1 SHA512 SSDEEP TLSH

        FormatNew.mpa.givemenitro

        • Path C:\Users\Admin\Desktop\FormatNew.mpa.givemenitro
        • Size 313KB
        • SHA256 c153b0a89edec2ada7e598c33f10557eb0c7af35a2b49a0c9c5712fce10e8128
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GetImport.TS

        • Path C:\Users\Admin\Desktop\GetImport.TS
        • Size 861KB
        • SHA256 6e3ba68794f87f66d86901f8dc3d61de855c55b84ccb7401c3b2526e19c3100b
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GetImport.TS.givemenitro

        • Path C:\Users\Admin\Desktop\GetImport.TS.givemenitro
        • Size 862KB
        • SHA256 97b5ee44c892f6199e55274f74e49288383b975aa4844ce705b295a676a78e4a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GrantSave.css

        • Path C:\Users\Admin\Desktop\GrantSave.css
        • Size 548KB
        • SHA256 2adf343f29196260d5fd48da89ba41d88a6bc9cb3f65e7918380bab80e4a5185
        • MD5 SHA1 SHA512 SSDEEP TLSH

        GrantSave.css.givemenitro

        • Path C:\Users\Admin\Desktop\GrantSave.css.givemenitro
        • Size 548KB
        • SHA256 2b13d79c6a4878a9c66d5dc242bc501fb294bdfd58a347b6dee9afee3e35934d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LimitUnlock.dib

        • Path C:\Users\Admin\Desktop\LimitUnlock.dib
        • Size 595KB
        • SHA256 2684b61f438ef44c6bc1b8849d2ad5ca8f2c9663b1b1841cdd4d5af4eee47e21
        • MD5 SHA1 SHA512 SSDEEP TLSH

        LimitUnlock.dib.givemenitro

        • Path C:\Users\Admin\Desktop\LimitUnlock.dib.givemenitro
        • Size 595KB
        • SHA256 588984eccf1468cbebf3dcc03d2526e19b161db87c058b6a113c070fef7136a7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MeasureUndo.vst

        • Path C:\Users\Admin\Desktop\MeasureUndo.vst
        • Size 344KB
        • SHA256 b33d64096bde221e87b5da98ef3a0faa9852cf4ea51a4b89ca7ba69695f11508
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MeasureUndo.vst.givemenitro

        • Path C:\Users\Admin\Desktop\MeasureUndo.vst.givemenitro
        • Size 345KB
        • SHA256 e492508beb64eb44b48333ed5b6c47950d1953ca9cfc6cbbce123f2682625455
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MergeCompress.MTS

        • Path C:\Users\Admin\Desktop\MergeCompress.MTS
        • Size 423KB
        • SHA256 5eac0dcdcf7b44b4143318c3a23cdca28bd9c14dc70e9ce87b3c6df45ba67a8c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MergeCompress.MTS.givemenitro

        • Path C:\Users\Admin\Desktop\MergeCompress.MTS.givemenitro
        • Size 423KB
        • SHA256 9cef3349c0be43f6adb8e5eb19d30f87fbb5ae0a6d3ffa5af96c693b6a44fb39
        • MD5 SHA1 SHA512 SSDEEP TLSH

        Microsoft Edge.lnk

        • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk
        • Size 2KB
        • SHA256 b3b8a33f763479757ec3ec3e58cff24c8979ea662a18ad271f214c41ad7b6cb2
        • MD5 SHA1 SHA512 TLSH

        Microsoft Edge.lnk.givemenitro

        • Path C:\Users\Admin\Desktop\Microsoft Edge.lnk.givemenitro
        • Size 2KB
        • SHA256 fb617886fe63796b75f916eec7f6e6be193612bba54fa91b382b2528967b2e1e
        • MD5 SHA1 SHA512 TLSH

        MountComplete.tif

        • Path C:\Users\Admin\Desktop\MountComplete.tif
        • Size 219KB
        • SHA256 ee9581b3375a55a3121a05a9d85b83c40a820e9f704034aecffd47eddc377979
        • MD5 SHA1 SHA512 SSDEEP TLSH

        MountComplete.tif.givemenitro

        • Path C:\Users\Admin\Desktop\MountComplete.tif.givemenitro
        • Size 219KB
        • SHA256 44dd409c05cdb275fe73bcee12cc9bb5f14e8727cf675ed423364d48ec3a01c3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OutAssert.wmv

        • Path C:\Users\Admin\Desktop\OutAssert.wmv
        • Size 266KB
        • SHA256 206d4c259aa36053c72b154d20f3164892615017dd76abb1b71232885b0fc787
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OutAssert.wmv.givemenitro

        • Path C:\Users\Admin\Desktop\OutAssert.wmv.givemenitro
        • Size 266KB
        • SHA256 55fa563697f0a580508b974d732767c1a1498d1f9b16a3c4cdd9425fb03473d3
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OutUndo.vdx

        • Path C:\Users\Admin\Desktop\OutUndo.vdx
        • Size 250KB
        • SHA256 75ffa75c9662aa21ee256e67047cecc42e15c0063b7ec6da8e11b92f13c07c52
        • MD5 SHA1 SHA512 SSDEEP TLSH

        OutUndo.vdx.givemenitro

        • Path C:\Users\Admin\Desktop\OutUndo.vdx.givemenitro
        • Size 251KB
        • SHA256 61d730f715c6f9c9815909eaa5b3ae8740a7b96f3002d391070bab64058a5d2d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PublishDismount.zip

        • Path C:\Users\Admin\Desktop\PublishDismount.zip
        • Size 626KB
        • SHA256 3b77bdbef1368667b60e02fbd727e6780860d1dcf49e84462782f2ac1c06a243
        • MD5 SHA1 SHA512 SSDEEP TLSH

        PublishDismount.zip.givemenitro

        • Path C:\Users\Admin\Desktop\PublishDismount.zip.givemenitro
        • Size 627KB
        • SHA256 dcb08b08565c1ccaa0324e1fae1063e9a5544f32c319978ff0d79843b19d4ed8
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReceiveReset.wdp

        • Path C:\Users\Admin\Desktop\ReceiveReset.wdp
        • Size 391KB
        • SHA256 e287891d2bb0afdbb3aab6bd1e64d4b0c06ea99c2bdc3bf33e7334833c4a9fe7
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ReceiveReset.wdp.givemenitro

        • Path C:\Users\Admin\Desktop\ReceiveReset.wdp.givemenitro
        • Size 392KB
        • SHA256 87f2a9ea9fd81cc88fe0f9ddbd00bb063bd2a275aa03bea5f7684dd246cd4f7a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RenameBlock.bin

        • Path C:\Users\Admin\Desktop\RenameBlock.bin
        • Size 407KB
        • SHA256 543cffb69de9efd3f119eefcce7e1f8b1cdad8ea58525cd2345bc057c390831c
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RenameBlock.bin.givemenitro

        • Path C:\Users\Admin\Desktop\RenameBlock.bin.givemenitro
        • Size 407KB
        • SHA256 0d06ed89c3fc1a1dee63738ed77098a6f5fd1a61e588fa3493c3df092fbc92d5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResetAdd.bmp

        • Path C:\Users\Admin\Desktop\ResetAdd.bmp
        • Size 611KB
        • SHA256 09da329c210df4ccaab9f5c8b46676353fcc25dcb0f3d5f32711c458f7392fd2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        ResetAdd.bmp.givemenitro

        • Path C:\Users\Admin\Desktop\ResetAdd.bmp.givemenitro
        • Size 611KB
        • SHA256 b33f32e1fd712b56890e01e6430c396692bc19e2d8d9149a3fb99b6218d39c33
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RestartSwitch.vbs

        • Path C:\Users\Admin\Desktop\RestartSwitch.vbs
        • Size 376KB
        • SHA256 673be62fccccd9f155df0e8f621f731ddccc04ee01b2dedef4e5e159aba3a044
        • MD5 SHA1 SHA512 SSDEEP TLSH

        RestartSwitch.vbs.givemenitro

        • Path C:\Users\Admin\Desktop\RestartSwitch.vbs.givemenitro
        • Size 376KB
        • SHA256 10513ef44fef8628475b228d0912257dd20e88813aa942aa81afd896785f8e31
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SendLock.vsd

        • Path C:\Users\Admin\Desktop\SendLock.vsd
        • Size 485KB
        • SHA256 8196e4cde2657fb16ab506b1b3cadfe11c36d2fa02ac47e1b1613b0ae47b07f6
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SendLock.vsd.givemenitro

        • Path C:\Users\Admin\Desktop\SendLock.vsd.givemenitro
        • Size 486KB
        • SHA256 f0738b463159d1ae82018dd02f0ea87629e67970e2e881889714c96c765481f2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SendUnpublish.bat

        • Path C:\Users\Admin\Desktop\SendUnpublish.bat
        • Size 564KB
        • SHA256 ce42dd81b275b2ab276ec4f997d97db142be3af528928e183a8c99602661ec6a
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SendUnpublish.bat.givemenitro

        • Path C:\Users\Admin\Desktop\SendUnpublish.bat.givemenitro
        • Size 564KB
        • SHA256 bcdb5b8f5bb00b40e116ee723f7f32dfa28f78e295119d3cbf40ccc63ea72192
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SplitResize.vsw

        • Path C:\Users\Admin\Desktop\SplitResize.vsw
        • Size 579KB
        • SHA256 c213d1e667d2ea423d45e4c19007aa75a6934ce6ba749e59a2075fd767f3ec9d
        • MD5 SHA1 SHA512 SSDEEP TLSH

        SplitResize.vsw.givemenitro

        • Path C:\Users\Admin\Desktop\SplitResize.vsw.givemenitro
        • Size 580KB
        • SHA256 ff8dca6ac13f3170a5ee919af0d4fc2e10bde7914bb2e0209c9f84c8c0381cb2
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnblockJoin.mpeg

        • Path C:\Users\Admin\Desktop\UnblockJoin.mpeg
        • Size 329KB
        • SHA256 5b98d04884cfcbad80ff173d327392d6e1b2a8c7a84da2af60bb4b8ee16caa54
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UnblockJoin.mpeg.givemenitro

        • Path C:\Users\Admin\Desktop\UnblockJoin.mpeg.givemenitro
        • Size 329KB
        • SHA256 4389a5f4b8e5b50c8359a3cbe685eee145a7b3ab506c4943f8ba3ecf67c5b01e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UndoRequest.xlsx

        • Path C:\Users\Admin\Desktop\UndoRequest.xlsx
        • Size 9KB
        • SHA256 348ba37a74fe04e6426f7c192f0e75deee52f9f18c67b3a8930b32e2dc7a61b5
        • MD5 SHA1 SHA512 SSDEEP TLSH

        UndoRequest.xlsx.givemenitro

        • Path C:\Users\Admin\Desktop\UndoRequest.xlsx.givemenitro
        • Size 10KB
        • SHA256 929135f4748664d61aab05ebf8df43b5d446aca075f8b8f164c838c469b74607
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WaitExpand.reg

        • Path C:\Users\Admin\Desktop\WaitExpand.reg
        • Size 470KB
        • SHA256 fcac7f9b03f8846c6780fdf2b94bb030927dd07b3f2a9c9cd09bd90f0a7c6137
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WaitExpand.reg.givemenitro

        • Path C:\Users\Admin\Desktop\WaitExpand.reg.givemenitro
        • Size 470KB
        • SHA256 b53ff81eff36fcf02ed07ea6d5320de233fe78b24ad37863eb9fbe0ae8f600dd
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WatchUnpublish.xltx

        • Path C:\Users\Admin\Desktop\WatchUnpublish.xltx
        • Size 532KB
        • SHA256 c79439874f799d014b4dc5153fa3c779a815722412d7110b51d1d61c27dd039e
        • MD5 SHA1 SHA512 SSDEEP TLSH

        WatchUnpublish.xltx.givemenitro

        • Path C:\Users\Admin\Desktop\WatchUnpublish.xltx.givemenitro
        • Size 533KB
        • SHA256 1afd01ee12914ea0eb6be35e15d8abf1c5cec004e9c50d8b824580da6c5ede07
        • MD5 SHA1 SHA512 SSDEEP TLSH

        desktop.ini

        • Path C:\Users\Admin\Desktop\desktop.ini
        • Size 282B
        • SHA256 4b9d687ac625690fd026ed4b236dad1cac90ef69e7ad256cc42766a065b50026
        • MD5 SHA1 SHA512 TLSH

        desktop.ini.givemenitro

        • Path C:\Users\Admin\Desktop\desktop.ini.givemenitro
        • Size 564B
        • SHA256 9b493b62d61bb4220e8c88d20f93824ded39c14a48e5a16040f112f85ceacb87
        • MD5 SHA1 SHA512 TLSH

        memory/5080-0-0x0000000000E50000-0x0000000000E68000-memory.dmp

        memory/5080-2-0x0000000005940000-0x00000000059D2000-memory.dmp

        memory/5080-109-0x00000000058A0000-0x00000000058B0000-memory.dmp

        memory/5080-110-0x00000000058A0000-0x00000000058B0000-memory.dmp

        memory/5080-111-0x00000000058A0000-0x00000000058B0000-memory.dmp

        memory/5080-108-0x0000000006510000-0x000000000651A000-memory.dmp

        memory/5080-3-0x00000000058A0000-0x00000000058B0000-memory.dmp

        memory/5080-1-0x0000000005EF0000-0x0000000006496000-memory.dmp