Analysis
- max time kernel
149s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20260513-en - resource tags
arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows - submitted
02/08/2026, 11:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe
- Size 1.7MB
- Sample260802-nnjyjaywas
- SHA256 d4d88b1fcb13f735bc2e58c6817df66b6754b969120185f138112aa5eec81383
- MD5 66767d2aaade2203135331b9beebf088
- SHA1 1a3dda9c20e284d4c188a58d3a333718abe5ae4c
- SHA512 9a8c7907eb5ffce4850e406a4bea3664fac1bb2ab25b6c83c7f6703ab7bf1b3aaef1ead67990ae91880b4275e9636c1e5f58c839bbace82bac597d5c91c0ccf6
- SSDEEP 24576:RrYottM3V52zhP+427kZVl1bXC/JKlRjW3Z9ZrUv7TVzc6IIA0JlupmSydRd/xio:REUpQ9avfVJYm7FUfRty
- TLSH T10085F759A24BCAF0D58706F0244AB6B65F74BE38D0358D26EBC9FF5AC7F364700A5206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 4288 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 4168 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe 4168 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 5116 vssvc.exe Token: SeRestorePrivilege 5116 vssvc.exe Token: SeAuditPrivilege 5116 vssvc.exe Token: SeIncreaseQuotaPrivilege 4828 WMIC.exe Token: SeSecurityPrivilege 4828 WMIC.exe Token: SeTakeOwnershipPrivilege 4828 WMIC.exe Token: SeLoadDriverPrivilege 4828 WMIC.exe Token: SeSystemProfilePrivilege 4828 WMIC.exe Token: SeSystemtimePrivilege 4828 WMIC.exe Token: SeProfSingleProcessPrivilege 4828 WMIC.exe Token: SeIncBasePriorityPrivilege 4828 WMIC.exe Token: SeCreatePagefilePrivilege 4828 WMIC.exe Token: SeBackupPrivilege 4828 WMIC.exe Token: SeRestorePrivilege 4828 WMIC.exe Token: SeShutdownPrivilege 4828 WMIC.exe Token: SeDebugPrivilege 4828 WMIC.exe Token: SeSystemEnvironmentPrivilege 4828 WMIC.exe Token: SeRemoteShutdownPrivilege 4828 WMIC.exe Token: SeUndockPrivilege 4828 WMIC.exe Token: SeManageVolumePrivilege 4828 WMIC.exe Token: 33 4828 WMIC.exe Token: 34 4828 WMIC.exe Token: 35 4828 WMIC.exe Token: 36 4828 WMIC.exe Token: SeIncreaseQuotaPrivilege 4828 WMIC.exe Token: SeSecurityPrivilege 4828 WMIC.exe Token: SeTakeOwnershipPrivilege 4828 WMIC.exe Token: SeLoadDriverPrivilege 4828 WMIC.exe Token: SeSystemProfilePrivilege 4828 WMIC.exe Token: SeSystemtimePrivilege 4828 WMIC.exe Token: SeProfSingleProcessPrivilege 4828 WMIC.exe Token: SeIncBasePriorityPrivilege 4828 WMIC.exe Token: SeCreatePagefilePrivilege 4828 WMIC.exe Token: SeBackupPrivilege 4828 WMIC.exe Token: SeRestorePrivilege 4828 WMIC.exe Token: SeShutdownPrivilege 4828 WMIC.exe Token: SeDebugPrivilege 4828 WMIC.exe Token: SeSystemEnvironmentPrivilege 4828 WMIC.exe Token: SeRemoteShutdownPrivilege 4828 WMIC.exe Token: SeUndockPrivilege 4828 WMIC.exe Token: SeManageVolumePrivilege 4828 WMIC.exe Token: 33 4828 WMIC.exe Token: 34 4828 WMIC.exe Token: 35 4828 WMIC.exe Token: 36 4828 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 4168 wrote to memory of 4288 4168 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe 93 PID 4288 wrote to memory of 4828 4288 cmd.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4168 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{02A89138-3F30-4308-9980-691E8B0C944F}'" delete2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:4288 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{02A89138-3F30-4308-9980-691E8B0C944F}'" delete3⤵
- Suspicious use of AdjustPrivilegeToken
PID:4828
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:5116