1bb81d0993428464d0787072f907310aacf3651a3f60ae150b0a4118d2b1049f

Analysis

max time kernel
150s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 12:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Size 811KB
Sample260505-p6n6msgv8t
SHA256 1bb81d0993428464d0787072f907310aacf3651a3f60ae150b0a4118d2b1049f
MD5 aea3596a03d4979157b41272ab940127
SHA1 ba9a91884ecb2eddc394048740e5e4075181d9bd
SHA512 2c45df4444e756335f20c1ac16be32c7e9aa7eaee471fd6aedc31152b584407a4acd81c87c49b7f7d261253f7825aa8b7996fa5f7b0ff122d13a818205e1324d
SSDEEP 6144:tpqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCH:tpqiC/2OGAtkCP4cejGSOpRK3CnIi
TLSH
T189058E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	system3_.exe

Executes dropped EXE 2 IoCs

pid	Process
3268	system3_.exe
2452	system3_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	system3_.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4156-0-0x0000000000400000-0x00000000004E1000-memory.dmp	autoit_exe
behavioral2/files/0x000700000000d3e6-10.dat	autoit_exe
behavioral2/memory/2452-15-0x0000000000400000-0x00000000004E1000-memory.dmp	autoit_exe
behavioral2/memory/4156-46-0x0000000000400000-0x00000000004E1000-memory.dmp	autoit_exe
behavioral2/memory/3268-49-0x0000000000400000-0x00000000004E1000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main	system3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	system3_.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3119821332-640943685-2562343641-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4156	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
4156	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
3268	system3_.exe
3268	system3_.exe
2452	system3_.exe
2452	system3_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4156 wrote to memory of 2224	4156	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe	79
PID 2224 wrote to memory of 4916	2224	cmd.exe	81
PID 4156 wrote to memory of 2504	4156	2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe	82
PID 2504 wrote to memory of 1652	2504	cmd.exe	84
PID 3268 wrote to memory of 708	3268	system3_.exe	89
PID 708 wrote to memory of 4792	708	cmd.exe	92
PID 3268 wrote to memory of 616	3268	system3_.exe	93
PID 616 wrote to memory of 1152	616	cmd.exe	95
PID 580 wrote to memory of 2452	580	explorer.exe	97

C:\Users\Admin\AppData\Local\Temp\2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_aea3596a03d4979157b41272ab940127_elex_stop.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4156
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2224
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4916
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2504
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1652

C:\Windows\explorer.exe
Explorer.exe system3_.exe
1⤵
PID:2040

C:\Users\Admin\Desktop\system3_.exe
C:\Users\Admin\Desktop\system3_.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3268
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:708
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:616
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1152

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:580
- C:\Users\Admin\Desktop\system3_.exe
  "C:\Users\Admin\Desktop\system3_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 4KB
SHA256 0300e9ddb527990e8b59d06e9ccf3ec2bd92d3bbd0ef4fba69d6336e4195e82d
MD5 5f036f91e86e30f749961506951d51eb
SHA1 acb87b59117c6e2db86f98c4c8bac52eade97cd4
SHA512 341f250cf3764207b5328a12b31016c0750daddcd16722b4bcef502bcbef7ef379abb601649ee6c3fdf121f3d3cd6890c8a80e5dae3169fe56ef82af20631944
SSDEEP 96:Dbonzjs6o1BXl7EV4/sClywa3UHimRkISatmQFjm:Dbsns6KXxUrClywawinLatvFjm
TLSH
T100A19E44A75AEB61C331EBB6829B7B51033B6D20178468FAEFDAA1E1695B44C143C3C2
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 71ccd39de69ec147afd8ad4337a36829dcababbf40897250380c7770de551242
MD5 2595e903fcb3b99996adb2cc2bf504c8
SHA1 89954e0577e83e0008d58a2dc6cd0aaad2972a62
SHA512 71a76aa25ce3ea545922ad9cee54cd3fff4c971ee4e5ddf6aa4832743db48da795ae8e76883cf5e5acab6818e8aba44515c72848579c476c54bda2e43e0cac35
TLSH
T1CA31CE4EA2113027D686BF72D8CEBE93CDB033476BCAD05B18455E8229AAFD11FC81C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

57C8EDB95DF3F0AD4EE2DC2B8CFD4157

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\57C8EDB95DF3F0AD4EE2DC2B8CFD4157
Size 342B
SHA256 5361e2ccdd6fcb5b971d9d1a0ed5c8fd5012ec6c3d38868e4b092c10a2a6bc3a
MD5 4bf8f0b5b41a04a2ae3346ae1b687c47
SHA1 761c559a7646724582adceb55911b7509b38dfed
SHA512 5012624a61cbfc2caa695cc350f5d8e00f2f629d2a3324ae474ceaa3696e23b69ef8e6f11188ed5e8702f298039f881f7b737a635ccfd841d6f3c6270936048b
TLSH
T157E05E122BE80214F6770A3CA873A5499977B76B6A51CBDD0275018E5C26F62CD3372D
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 4970b3c7408d0c82b1d96bdf48e7312dd224dd0bdfbeb3ddadf93f39077de8e6
MD5 eda04324961d940882bc522f19f7c0e3
SHA1 3d400cdd2f590233a4ca030120fd692ea389024e
SHA512 2d43fc5f913c52da8577fd356a52a34c8157ddae2447d6733f9f36204b29ad9aaf330af757b23f581924f4dbed007f1b506cc6fbd625ea1ed728f16b84aae330
TLSH
T164C04C1177215776F11409BF159659510EF59A528E92834C1B70731C642B98198E0D05
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 91a39369200b194a64e1b4e662ac0585c990f624aa814b3a62865a0ff6b4c579
MD5 5f1e783a4eb564e89435d7fb08fe44bd
SHA1 cd3225d693daba3fb26f8f11e2ea1f272669ee70
SHA512 235fe68e99bc680a069cb289d3aec3c950fded8ff435169e6a632af035390b0fc9e35f174775d9e2fd0af2c07439c76f283868cc2ccbda80c75232b8ffed6e06
TLSH
T17BC09B1473654725F10D113D79E5160417B94115B5D6C3044B745634D9196401872D09
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.ini

Path C:\Users\Admin\Desktop\autorun.ini
Size 102B
SHA256 94a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
MD5 948c74cd98911b420ff89dac13399bcb
SHA1 76dfc73518f003953923b1b4f2b973f4bb56a411
SHA512 b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
TLSH
T1F3B01221E3BC0950040CF48CC3800CF2F023BD401008090372E1584C838000E573FC78
MD5 SHA1 SHA512 TLSH

Submit Download

system3_.exe

Path C:\Users\Admin\Desktop\system3_.exe
Size 811KB
SHA256 1bb81d0993428464d0787072f907310aacf3651a3f60ae150b0a4118d2b1049f
MD5 aea3596a03d4979157b41272ab940127
SHA1 ba9a91884ecb2eddc394048740e5e4075181d9bd
SHA512 2c45df4444e756335f20c1ac16be32c7e9aa7eaee471fd6aedc31152b584407a4acd81c87c49b7f7d261253f7825aa8b7996fa5f7b0ff122d13a818205e1324d
SSDEEP 6144:tpqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCH:tpqiC/2OGAtkCP4cejGSOpRK3CnIi
TLSH
T189058E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2452-14-0x0000000001670000-0x000000000174F000-memory.dmp

Download

memory/2452-15-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/3268-17-0x0000000001230000-0x000000000130F000-memory.dmp

Download

memory/3268-49-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/4156-16-0x0000000001AB0000-0x0000000001B8F000-memory.dmp

Download

memory/4156-0-0x0000000000400000-0x00000000004E1000-memory.dmp

Download

memory/4156-1-0x000000000047D000-0x000000000047E000-memory.dmp

Download

memory/4156-46-0x0000000000400000-0x00000000004E1000-memory.dmp

Download