b5522712d549f34246e022328fe9d86559d560668bb3b0f69e0838392016c0e5

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
15/04/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
Size 3.5MB
Sample260415-m1636ae12y
SHA256 b5522712d549f34246e022328fe9d86559d560668bb3b0f69e0838392016c0e5
MD5 6c66ec7f0c84bccf1221830531dbed6d
SHA1 eca5e57c274b4fed4efdba22e201adc7563d2dca
SHA512 0c0075fcd0bbddc032cfe30f7e84d75c029c7529875f2ba446e31e4301b41215304cd76d01d2a6438f5fece7f96286085da0f430b33d996de90f79e0fa8a94d5
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHtK:jbCjPKNqQIFIbBMy+bCjPKNqQIN
TLSH
T11C06C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery execution persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3032	winmgr21.exe
4496	winmgr21.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-745935970-1373868228-562466063-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\2 = "C:\\ProgramData\\winmgr21.exe"	winmgr21.exe

AutoIT Executable 2 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/files/0x00080000000243b5-7.dat	autoit_exe
behavioral1/files/0x00070000000243a8-8.dat	autoit_exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3032 set thread context of 4508	3032	winmgr21.exe	93
PID 4508 set thread context of 2564	4508	RegAsm.exe	96

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 3 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe:Zone.Identifier:$DATA	2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 29 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr21.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 3 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe:Zone.Identifier:$DATA	2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
File created	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe
File opened for modification	C:\ProgramData\winmgr21.exe:Zone.Identifier:$DATA	winmgr21.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 25 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2184	schtasks.exe
5020	schtasks.exe
4160	schtasks.exe
1868	schtasks.exe
3124	schtasks.exe
2180	schtasks.exe
4640	schtasks.exe
4264	schtasks.exe
2688	schtasks.exe
3768	schtasks.exe
3184	schtasks.exe
4652	schtasks.exe
4620	schtasks.exe
2024	schtasks.exe
972	schtasks.exe
3048	schtasks.exe
4668	schtasks.exe
688	schtasks.exe
1428	schtasks.exe
872	schtasks.exe
1756	schtasks.exe
4380	schtasks.exe
4952	schtasks.exe
760	schtasks.exe
636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 56 IoCs

pid	Process
2760	2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
2760	2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
4496	winmgr21.exe
4496	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe
3032	winmgr21.exe

Suspicious behavior: GetForegroundWindowSpam 3 IoCs

pid	Process
2760	2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
3032	winmgr21.exe
4496	winmgr21.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4508	RegAsm.exe

Suspicious use of WriteProcessMemory 35 IoCs

description	pid	Process	procid_target
PID 2760 wrote to memory of 3032	2760	2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe	92
PID 3032 wrote to memory of 4508	3032	winmgr21.exe	93
PID 3032 wrote to memory of 4508	3032	winmgr21.exe	93
PID 3032 wrote to memory of 4508	3032	winmgr21.exe	93
PID 3032 wrote to memory of 4620	3032	winmgr21.exe	94
PID 4508 wrote to memory of 2564	4508	RegAsm.exe	96
PID 4508 wrote to memory of 2564	4508	RegAsm.exe	96
PID 4508 wrote to memory of 2564	4508	RegAsm.exe	96
PID 4508 wrote to memory of 2564	4508	RegAsm.exe	96
PID 4508 wrote to memory of 2564	4508	RegAsm.exe	96
PID 4508 wrote to memory of 2564	4508	RegAsm.exe	96
PID 3032 wrote to memory of 3124	3032	winmgr21.exe	100
PID 3032 wrote to memory of 2180	3032	winmgr21.exe	103
PID 3032 wrote to memory of 4640	3032	winmgr21.exe	105
PID 3032 wrote to memory of 760	3032	winmgr21.exe	107
PID 3032 wrote to memory of 636	3032	winmgr21.exe	109
PID 3032 wrote to memory of 2024	3032	winmgr21.exe	111
PID 3032 wrote to memory of 2184	3032	winmgr21.exe	113
PID 3032 wrote to memory of 972	3032	winmgr21.exe	115
PID 3032 wrote to memory of 4264	3032	winmgr21.exe	117
PID 3032 wrote to memory of 2688	3032	winmgr21.exe	119
PID 3032 wrote to memory of 3048	3032	winmgr21.exe	121
PID 3032 wrote to memory of 1756	3032	winmgr21.exe	123
PID 3032 wrote to memory of 4668	3032	winmgr21.exe	125
PID 3032 wrote to memory of 688	3032	winmgr21.exe	127
PID 3032 wrote to memory of 3768	3032	winmgr21.exe	129
PID 3032 wrote to memory of 1428	3032	winmgr21.exe	131
PID 3032 wrote to memory of 4380	3032	winmgr21.exe	133
PID 3032 wrote to memory of 3184	3032	winmgr21.exe	135
PID 3032 wrote to memory of 4652	3032	winmgr21.exe	137
PID 3032 wrote to memory of 872	3032	winmgr21.exe	139
PID 3032 wrote to memory of 5020	3032	winmgr21.exe	141
PID 3032 wrote to memory of 4160	3032	winmgr21.exe	143
PID 3032 wrote to memory of 1868	3032	winmgr21.exe	145
PID 3032 wrote to memory of 4952	3032	winmgr21.exe	147

C:\Users\Admin\AppData\Local\Temp\2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:2760
- C:\ProgramData\winmgr21.exe
  C:\ProgramData\winmgr21.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: GetForegroundWindowSpam
  - Suspicious use of WriteProcessMemory
  PID:3032
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of SetThreadContext
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:4508
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" /stext C:\ProgramData\Mails.txt
      4⤵
      PID:2564
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4620
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3124
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2180
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4640
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:760
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:636
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2024
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2184
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:972
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4264
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2688
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3048
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1756
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4668
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:688
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3768
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1428
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4380
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3184
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4652
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:872
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5020
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4160
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1868
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr21.exe" /tr "C:\ProgramData\winmgr21.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4952

C:\ProgramData\winmgr21.exe
C:\ProgramData\winmgr21.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
PID:4496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

winmgr21.exe

Path C:\ProgramData\winmgr21.exe
Size 3.5MB
SHA256 0b7bdb8511893e8cb3d132563ef3156c59fb5ed3f5a4494452ff385a0bb43c53
MD5 4aaf45750444acf184dabc9bd3dcb679
SHA1 bd89b796f7adb8077a68358d8ee7066c11e71aca
SHA512 dd37287b09daa87d6023c405d92f6b2bb65572ece09cc99ddccc8f9851d6ba24e6b19df4f89fe877833695105057dfc68328f96c2912c8995d51e3d33bfa0788
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHtM:jbCjPKNqQIFIbBMy+bCjPKNqQIF
TLSH
T1ED06C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-15_6c66ec7f0c84bccf1221830531dbed6d_elex_stop.exe
Size 3.5MB
SHA256 b5522712d549f34246e022328fe9d86559d560668bb3b0f69e0838392016c0e5
MD5 6c66ec7f0c84bccf1221830531dbed6d
SHA1 eca5e57c274b4fed4efdba22e201adc7563d2dca
SHA512 0c0075fcd0bbddc032cfe30f7e84d75c029c7529875f2ba446e31e4301b41215304cd76d01d2a6438f5fece7f96286085da0f430b33d996de90f79e0fa8a94d5
SSDEEP 24576:jbCj2sObHtqQ4QIYmdEo4MvlHYkU+xma5V7Dgwr/pSiSnYIH7BM7W+bCj2sObHtK:jbCjPKNqQIFIbBMy+bCjPKNqQIN
TLSH
T11C06C0C6F3EA40E6DC023FF5582567C79B34473647384059BBAA3D458F234A9C12ABB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2760-0-0x0000000000AC0000-0x0000000000B23000-memory.dmp

Download

memory/2760-10-0x0000000000AC0000-0x0000000000B23000-memory.dmp

Download

memory/3032-18-0x0000000000A30000-0x0000000000A93000-memory.dmp

Download

memory/4496-21-0x0000000000A30000-0x0000000000A93000-memory.dmp

Download

memory/4496-23-0x0000000000A30000-0x0000000000A93000-memory.dmp

Download

memory/4508-13-0x0000000000B00000-0x0000000000BAA000-memory.dmp

Download

memory/4508-14-0x0000000000F70000-0x0000000000F80000-memory.dmp

Download

memory/4508-19-0x0000000000F70000-0x0000000000F80000-memory.dmp

Download