Analysis
- max time kernel
149s - max time network
119s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
07/05/2026, 01:50
General
- Target 2026-05-07_128579e9a40f14917e4ac1f5b6c8a821_elex_stop.exe
- Size 3.5MB
- Sample260507-b9rt2sdv6x
- SHA256 cd4b84649b8e574ea21afbc61788fbe99ffba712e6083138a5761f20a06583b4
Malware Config
Signatures
- Custom signatureDetects executables packed with DNGuard 2 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-07_128579e9a40f14917e4ac1f5b6c8a821_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-07_128579e9a40f14917e4ac1f5b6c8a821_elex_stop.exe"1⤵
- System Location Discovery: System Language Discovery
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1220-0-0x0000000005000000-0x000000000511A000-memory.dmp
memory/1220-1-0x0000000005000000-0x000000000511A000-memory.dmp
memory/1220-2-0x0000000005000000-0x000000000511A000-memory.dmp
memory/1220-12-0x00000000045A0000-0x00000000045A1000-memory.dmp
memory/1220-24-0x0000000010000000-0x0000000010005000-memory.dmp
memory/1220-43-0x00000000073E0000-0x00000000073E1000-memory.dmp
memory/1220-45-0x0000000074BA1000-0x0000000074BA2000-memory.dmp
memory/1220-44-0x0000000007410000-0x0000000007411000-memory.dmp
memory/1220-46-0x00000000082C0000-0x00000000082D8000-memory.dmp
memory/1220-76-0x0000000074BA0000-0x0000000075151000-memory.dmp
memory/1220-54-0x00000000082C0000-0x00000000082D8000-memory.dmp
memory/1220-48-0x00000000082C0000-0x00000000082D8000-memory.dmp
memory/1220-28-0x0000000074BA0000-0x0000000075151000-memory.dmp
memory/1220-42-0x0000000007400000-0x0000000007401000-memory.dmp
memory/1220-41-0x0000000007500000-0x0000000007501000-memory.dmp
memory/1220-40-0x0000000007420000-0x0000000007421000-memory.dmp
memory/1220-39-0x0000000007430000-0x0000000007431000-memory.dmp
memory/1220-38-0x00000000045D0000-0x00000000045D1000-memory.dmp
memory/1220-37-0x00000000074A0000-0x00000000074A1000-memory.dmp
memory/1220-36-0x00000000074F0000-0x00000000074F1000-memory.dmp
memory/1220-35-0x00000000074E0000-0x00000000074E1000-memory.dmp
memory/1220-34-0x0000000007450000-0x0000000007451000-memory.dmp
memory/1220-33-0x0000000007440000-0x0000000007441000-memory.dmp
memory/1220-32-0x0000000007380000-0x0000000007381000-memory.dmp
memory/1220-31-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/1220-30-0x0000000077AA4000-0x0000000077AA5000-memory.dmp
memory/1220-29-0x00000000074D0000-0x00000000074D1000-memory.dmp
memory/1220-21-0x0000000010000000-0x0000000010005000-memory.dmp
memory/1220-18-0x0000000010000000-0x0000000010005000-memory.dmp
memory/1220-15-0x0000000010000000-0x0000000010005000-memory.dmp
memory/1220-13-0x0000000010000000-0x0000000010005000-memory.dmp
memory/1220-3-0x0000000005000000-0x000000000511A000-memory.dmp
memory/1220-77-0x0000000074BA0000-0x0000000075151000-memory.dmp
memory/1220-78-0x0000000074BA0000-0x0000000075151000-memory.dmp
memory/1220-79-0x0000000005000000-0x000000000511A000-memory.dmp
memory/1220-92-0x0000000074BA0000-0x0000000075151000-memory.dmp