072f9347b40387e3b93caec030ceb117f2be98de2f6f8efcd963919f6bbfd604

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
28/05/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe
Size 1.8MB
Sample260528-tr73esex7m
SHA256 072f9347b40387e3b93caec030ceb117f2be98de2f6f8efcd963919f6bbfd604
MD5 81e6715acf9b3c1e963f590dfbba426a
SHA1 f542ff14a303e2cc1e16db99f0386ea8a590297b
SHA512 50039319dc3b3bdd02a993a749873a3419fbb23dc2fd5663c0713bbbbe96e2d26a9b1b0e70adedd97858a722e08c74099d74ff3e2fa03b216d7d9de56cdc38df
SSDEEP 24576:3po/2+ttPJLfpRK3CsKj/Sj8x3lN65376wNoW3DboEvASb+HAd267t4VpVLdL:Ge2PJLa3CpEyN653+oDRASb+HAtuLdL
TLSH
T1B685F191B3C5A0F1C4523D72196BE235DB367D1527168A67FFE03F6BBE300609A2A361
MD5 SHA1 SHA512 SSDEEP TLSH

Score

5^/10

discovery

Malware Config

Signatures

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/3188-0-0x0000000000400000-0x00000000004BC000-memory.dmp	autoit_exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3188 set thread context of 1652	3188	2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe	80

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2356	1652	WerFault.exe	80

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 3188 wrote to memory of 1652	3188	2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe	80
PID 3188 wrote to memory of 1652	3188	2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe	80
PID 3188 wrote to memory of 1652	3188	2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe	80
PID 3188 wrote to memory of 1652	3188	2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe	80
PID 3188 wrote to memory of 1652	3188	2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3188
- C:\Users\Admin\AppData\Local\Temp\2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe
  "C:\Users\Admin\AppData\Local\Temp\2026-05-28_81e6715acf9b3c1e963f590dfbba426a_elex_stop.exe"
  2⤵
  PID:1652
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 16
    3⤵
    - Program crash
    PID:2356

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1652 -ip 1652
1⤵
PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3188-0-0x0000000000400000-0x00000000004BC000-memory.dmp

Download