8ce3af3bb7f8c1af5dc50dff3b83e9b54a90135caa5d905f77e75c472ab9dae9

Analysis

max time kernel
149s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
04/08/2026, 16:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Size 1.3MB
Sample260804-tz1nbavdkh
SHA256 8ce3af3bb7f8c1af5dc50dff3b83e9b54a90135caa5d905f77e75c472ab9dae9
MD5 2082a2508d884308033d5a684d1d9e9f
SHA1 15b4bb05657c5656ab374ecee94cd5c26aca8260
SHA512 e7871e21d356df269990d5336ec15d2c42fb3161a5a9dff1b2b3387527a289ee4edcc58de0a74a10dcee667a579174a406689933c5100372b7b1a2517aec69ec
SSDEEP 12288:3pqiC/2OGAtkCP4cejGSOpRK3C1SGe4RN:3po/2+ttPJLfpRK3C1SGhb
TLSH
T175659F02B3D680F1D85238711567E22A9B797D154726CE9BEBE03E379D311B09F2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	system3_.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system3_.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 2 IoCs

pid	Process
3224	system3_.exe
5072	system3_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	system3_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe

AutoIT Executable 7 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/840-0-0x0000000000400000-0x0000000000589000-memory.dmp	autoit_exe
behavioral1/files/0x000b000000024273-12.dat	autoit_exe
behavioral1/memory/3224-13-0x0000000000400000-0x0000000000589000-memory.dmp	autoit_exe
behavioral1/memory/5072-15-0x0000000000400000-0x0000000000589000-memory.dmp	autoit_exe
behavioral1/memory/5072-16-0x0000000000400000-0x0000000000589000-memory.dmp	autoit_exe
behavioral1/memory/840-33-0x0000000000400000-0x0000000000589000-memory.dmp	autoit_exe
behavioral1/memory/3224-34-0x0000000000400000-0x0000000000589000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
5100	cmd.exe
364	cmd.exe
3596	cmd.exe
4580	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\Software\Microsoft\Internet Explorer\Main	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1074038928-2032447174-945360078-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
840	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
840	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
3224	system3_.exe
3224	system3_.exe
5072	system3_.exe
5072	system3_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 840 wrote to memory of 3596	840	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe	87
PID 3596 wrote to memory of 3892	3596	cmd.exe	89
PID 840 wrote to memory of 4580	840	2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe	90
PID 4580 wrote to memory of 1552	4580	cmd.exe	92
PID 3224 wrote to memory of 5100	3224	system3_.exe	98
PID 4960 wrote to memory of 5072	4960	explorer.exe	100
PID 5100 wrote to memory of 3980	5100	cmd.exe	102
PID 3224 wrote to memory of 364	3224	system3_.exe	103
PID 364 wrote to memory of 3056	364	cmd.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_2082a2508d884308033d5a684d1d9e9f_elex_stop.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3596
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3892
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4580
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1552

C:\Windows\explorer.exe
Explorer.exe system3_.exe
1⤵
PID:3296

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\Desktop\system3_.exe
  "C:\Users\Admin\Desktop\system3_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5072

C:\Users\Admin\Desktop\system3_.exe
C:\Users\Admin\Desktop\system3_.exe
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3224
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5100
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3980
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:364
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37996DB9BB614EAA7D6117AAB3E0F7C9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37996DB9BB614EAA7D6117AAB3E0F7C9
Size 421B
SHA256 2e5207938040412d0f5dd774bbd9da35df251754f0c076117f2b8969d43821e5
MD5 db81b79b24180bf86dc827634c42cdff
SHA1 e99b8256174664e09f2e95a9c8e6a9185d7cad36
SHA512 da3e3c78cd01b4ee4cbbdab1c3605d56d927704c68e859b7d55c22d590ae38cdd91455e9b4a3aafbbf4b6887023f7de9f893777e5a2c25012fd2da74db1b78a2
TLSH
T1B2E0A3619D7573D10FE0D800DDD4C48F0DF9C4C6195A66450B35EB7101D2A4ED96278F
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

37996DB9BB614EAA7D6117AAB3E0F7C9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37996DB9BB614EAA7D6117AAB3E0F7C9
Size 192B
SHA256 4cbcd97838522077dc3a1eb7e9c28549e6a0fd8e2056bedb4a3408557a3a889b
MD5 dc4927b4bfc336b732999e42cfa4dac3
SHA1 881d75b98f8d110b91f0e8a4247f159eb7bbb257
SHA512 8fe458c5010338caeffa31a9cb8d7b68602224a63f460a05e0e6be5ac6ed4a089d4e7f8a399b71ca19e89370386fa614b1d15d5c6d08d04c0a9330105c26d837
TLSH
T162C04C006F754A18FA16523F59D19B091BF9A108C587471A1BF41668671DA41BD72E09
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 2f0b4ef05e524f4fef9f41a961c1f7dbe1a75a2a3dc7d7261a069e1e93797433
MD5 dd4e600ee326ac8687c6597c33faf8fd
SHA1 b94b2e5f41188b5d25444fe28f689d7631e532ab
SHA512 70c3aa361a8daa96b2cdcb0cfd2247c2ce8087ea8fd0e22421ed2fe4282f1ca8dd5528bbb7043d02198452bc4533b867b4e42cfff67f98f0feebe03ce5b6176b
TLSH
T166C09214B3A9471AF20E617E7DE61B051BFA921AF6CAC3044BB81638D92CA4008B2D09
MD5 SHA1 SHA512 TLSH

Submit Download

setting[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\2CAWFFZ1\setting[2].htm
Size 173B
SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
MD5 bcd560eba80b849c980a5123047bc8f8
SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b
TLSH
T176C0806D6B533C9874973B3950C39160E1DC503023D9041112704507F0CB1D78DC23D1
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.ini

Path C:\Users\Admin\Desktop\autorun.ini
Size 102B
SHA256 94a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
MD5 948c74cd98911b420ff89dac13399bcb
SHA1 76dfc73518f003953923b1b4f2b973f4bb56a411
SHA512 b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
TLSH
T1F3B01221E3BC0950040CF48CC3800CF2F023BD401008090372E1584C838000E573FC78
MD5 SHA1 SHA512 TLSH

Submit Download

system3_.exe

Path C:\Users\Admin\Desktop\system3_.exe
Size 1.3MB
SHA256 8ce3af3bb7f8c1af5dc50dff3b83e9b54a90135caa5d905f77e75c472ab9dae9
MD5 2082a2508d884308033d5a684d1d9e9f
SHA1 15b4bb05657c5656ab374ecee94cd5c26aca8260
SHA512 e7871e21d356df269990d5336ec15d2c42fb3161a5a9dff1b2b3387527a289ee4edcc58de0a74a10dcee667a579174a406689933c5100372b7b1a2517aec69ec
SSDEEP 12288:3pqiC/2OGAtkCP4cejGSOpRK3C1SGe4RN:3po/2+ttPJLfpRK3C1SGhb
TLSH
T175659F02B3D680F1D85238711567E22A9B797D154726CE9BEBE03E379D311B09F2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/840-0-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/840-33-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/840-1-0x000000000047D000-0x000000000047E000-memory.dmp

Download

memory/3224-13-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/3224-34-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/5072-16-0x0000000000400000-0x0000000000589000-memory.dmp

Download

memory/5072-15-0x0000000000400000-0x0000000000589000-memory.dmp

Download