Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260706-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
08/07/2026, 22:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe
Resource
win10v2004-20260513-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe
Resource
win11ltsc2024-20260706-en
3 signatures
150 seconds
General
- Target 2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe
- Size 926KB
- Sample260708-2ap5aahz5m
- SHA256 8eae138e533bd6535a62bbf8f69fcc26e9e50037c0ee6e9e727c9907dec7a768
- MD5 77b180a14ca009d44e5ff7501bbb9258
- SHA1 b2e59858b7a74789fcd2ce5c9e9bfc1c1a76c827
- SHA512 446066b52e218fa97228233121eb2f4dfa8aa7de93afb033939d4c8248c16079b8cbfca784d70186d407ca21162aa5cc9df83034ac27d11d64f1f02d96b08f92
- SSDEEP 12288:GCNy7WwhNke18SBlq06bR7+rUWHgyzkiwME4r5sEA096K+cmUUOkRX:ZySwB8SBlR6d7+rTgyzIIj+QU7R
- TLSH T150151AF96D8282B6CC8CADF652536E67B0947BFCD7444D0ABAE465CB3C8931035442BB
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\windows\system32\DriverStore\FileRepository\prnms003.inf_amd64_185217acce46dc3d\Amd64\PrintConfig.dll 2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4880 2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe 4880 2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-08_77b180a14ca009d44e5ff7501bbb9258_amadey_elex_lynx.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4880
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:3804
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵PID:2500