Analysis
- max time kernel
148s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
02/08/2026, 11:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
6 signatures
150 seconds
General
- Target 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe
- Size 1.7MB
- Sample260802-nnjyjaywas
- SHA256 d4d88b1fcb13f735bc2e58c6817df66b6754b969120185f138112aa5eec81383
- MD5 66767d2aaade2203135331b9beebf088
- SHA1 1a3dda9c20e284d4c188a58d3a333718abe5ae4c
- SHA512 9a8c7907eb5ffce4850e406a4bea3664fac1bb2ab25b6c83c7f6703ab7bf1b3aaef1ead67990ae91880b4275e9636c1e5f58c839bbace82bac597d5c91c0ccf6
- SSDEEP 24576:RrYottM3V52zhP+427kZVl1bXC/JKlRjW3Z9ZrUv7TVzc6IIA0JlupmSydRd/xio:REUpQ9avfVJYm7FUfRty
- TLSH T10085F759A24BCAF0D58706F0244AB6B65F74BE38D0358D26EBC9FF5AC7F364700A5206
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Executes a command shell one-liner 1 TTPs 1 IoCs
Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.
pid Process 1876 cmd.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 5092 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe 5092 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe 5768 WMIC.exe 5768 WMIC.exe 5768 WMIC.exe 5768 WMIC.exe - Suspicious use of AdjustPrivilegeToken 45 IoCs
description pid Process Token: SeBackupPrivilege 4072 vssvc.exe Token: SeRestorePrivilege 4072 vssvc.exe Token: SeAuditPrivilege 4072 vssvc.exe Token: SeIncreaseQuotaPrivilege 5768 WMIC.exe Token: SeSecurityPrivilege 5768 WMIC.exe Token: SeTakeOwnershipPrivilege 5768 WMIC.exe Token: SeLoadDriverPrivilege 5768 WMIC.exe Token: SeSystemProfilePrivilege 5768 WMIC.exe Token: SeSystemtimePrivilege 5768 WMIC.exe Token: SeProfSingleProcessPrivilege 5768 WMIC.exe Token: SeIncBasePriorityPrivilege 5768 WMIC.exe Token: SeCreatePagefilePrivilege 5768 WMIC.exe Token: SeBackupPrivilege 5768 WMIC.exe Token: SeRestorePrivilege 5768 WMIC.exe Token: SeShutdownPrivilege 5768 WMIC.exe Token: SeDebugPrivilege 5768 WMIC.exe Token: SeSystemEnvironmentPrivilege 5768 WMIC.exe Token: SeRemoteShutdownPrivilege 5768 WMIC.exe Token: SeUndockPrivilege 5768 WMIC.exe Token: SeManageVolumePrivilege 5768 WMIC.exe Token: 33 5768 WMIC.exe Token: 34 5768 WMIC.exe Token: 35 5768 WMIC.exe Token: 36 5768 WMIC.exe Token: SeIncreaseQuotaPrivilege 5768 WMIC.exe Token: SeSecurityPrivilege 5768 WMIC.exe Token: SeTakeOwnershipPrivilege 5768 WMIC.exe Token: SeLoadDriverPrivilege 5768 WMIC.exe Token: SeSystemProfilePrivilege 5768 WMIC.exe Token: SeSystemtimePrivilege 5768 WMIC.exe Token: SeProfSingleProcessPrivilege 5768 WMIC.exe Token: SeIncBasePriorityPrivilege 5768 WMIC.exe Token: SeCreatePagefilePrivilege 5768 WMIC.exe Token: SeBackupPrivilege 5768 WMIC.exe Token: SeRestorePrivilege 5768 WMIC.exe Token: SeShutdownPrivilege 5768 WMIC.exe Token: SeDebugPrivilege 5768 WMIC.exe Token: SeSystemEnvironmentPrivilege 5768 WMIC.exe Token: SeRemoteShutdownPrivilege 5768 WMIC.exe Token: SeUndockPrivilege 5768 WMIC.exe Token: SeManageVolumePrivilege 5768 WMIC.exe Token: 33 5768 WMIC.exe Token: 34 5768 WMIC.exe Token: 35 5768 WMIC.exe Token: 36 5768 WMIC.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 5092 wrote to memory of 1876 5092 2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe 93 PID 1876 wrote to memory of 5768 1876 cmd.exe 95 - Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-02_66767d2aaade2203135331b9beebf088_dragonforce_elex.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SYSTEM32\cmd.execmd.exe /c C:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{757B6E51-E2D3-4B51-967C-8D8C8FDF554D}'" delete2⤵
- Executes a command shell one-liner
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\System32\wbem\WMIC.exeC:\Windows\System32\wbem\WMIC.exe shadowcopy where "ID='{757B6E51-E2D3-4B51-967C-8D8C8FDF554D}'" delete3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5768
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:4072