General
- Target 2026-07-30_a0c0f05724ddc47c403ddd684f900e45_elex_stop
- Size 1.2MB
- Sample260730-ndq9vswejh
- SHA256 8637292359e60d621d132efa9648866888510c77fadddf2b3ba8f4c5cb7f6171
- MD5 a0c0f05724ddc47c403ddd684f900e45
- SHA1 b215e91defa47bcaf5b883d40b8c0caad5f5e3ac
- SHA512 6473ec4eb4ebee45bfe719c49427e1359aaedf447299faa1fa42fab2e2953e6cd4711f725bbb1a06238fa023f295bc80703bb32b5625df3dfa730610972efa08
- SSDEEP 24576:7JeJfAqkjp98zHpie4XqDsj1dE1BcJ9nPx/igr:9eJfAJGpLoqDe1W1snP8
- TLSH T1FD45D00372E2B1F0E85958F51F57A37957E57C30562AAE0773D47E2B26311E0AA3A323
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-07-30_a0c0f05724ddc47c403ddd684f900e45_elex_stop.exe
Resource
win10v2004-20260513-en
18 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-30_a0c0f05724ddc47c403ddd684f900e45_elex_stop.exe
Resource
win11ltsc2024-20260709-en
16 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-07-30_a0c0f05724ddc47c403ddd684f900e45_elex_stop
- Size 1.2MB
- SHA256 8637292359e60d621d132efa9648866888510c77fadddf2b3ba8f4c5cb7f6171
- MD5 a0c0f05724ddc47c403ddd684f900e45
- SHA1 b215e91defa47bcaf5b883d40b8c0caad5f5e3ac
- SHA512 6473ec4eb4ebee45bfe719c49427e1359aaedf447299faa1fa42fab2e2953e6cd4711f725bbb1a06238fa023f295bc80703bb32b5625df3dfa730610972efa08
- SSDEEP 24576:7JeJfAqkjp98zHpie4XqDsj1dE1BcJ9nPx/igr:9eJfAJGpLoqDe1W1snP8
- TLSH T1FD45D00372E2B1F0E85958F51F57A37957E57C30562AAE0773D47E2B26311E0AA3A323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Executes dropped EXE
-
Adds Run key to start application
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1