General
- Target 2026-08-07_52b03616d37e5ee34871add5483828f4_elex_stop
- Size 672KB
- Sample260807-eghbpaxarf
- SHA256 c1b3101264d4b3fccfaff3bc67a2c6d4334966cd557fa6ecb7a38179ad9aa7df
- MD5 52b03616d37e5ee34871add5483828f4
- SHA1 75b4ec2d1b642c8cf216835c5b2d59809dc95b2b
- SHA512 1d7a10d9893f2281b2e09468d91e3b238158c77bcea933afc3056714ece823c7a4f17793cfb43e82265f2da701825cc3918ab0f503cbddde0dd778d045a1fcfa
- SSDEEP 6144:9/8JeJfEuGs8k/bUlgqjpJDHCq17WSTLp980sbpy3KR/ie5b2b2YfwHbmdUnmXr8:2JeJfEuGstgg/kjp98zHpie5ym6egr8
- TLSH T1FBE4BF1372E1B1F1D86625F41F679379A7B67C30563AAE0B63D43E1B16314A0AB36323
- MD5 SHA1 SHA512 SSDEEP TLSH
Static task
static1
2 signatures
Behavioral task
behavioral1
Sample
2026-08-07_52b03616d37e5ee34871add5483828f4_elex_stop.exe
Resource
win10v2004-20260513-en
19 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-07_52b03616d37e5ee34871add5483828f4_elex_stop.exe
Resource
win11ltsc2024-20260709-en
20 signatures
150 seconds
Malware Config
Targets
-
- Target 2026-08-07_52b03616d37e5ee34871add5483828f4_elex_stop
- Size 672KB
- SHA256 c1b3101264d4b3fccfaff3bc67a2c6d4334966cd557fa6ecb7a38179ad9aa7df
- MD5 52b03616d37e5ee34871add5483828f4
- SHA1 75b4ec2d1b642c8cf216835c5b2d59809dc95b2b
- SHA512 1d7a10d9893f2281b2e09468d91e3b238158c77bcea933afc3056714ece823c7a4f17793cfb43e82265f2da701825cc3918ab0f503cbddde0dd778d045a1fcfa
- SSDEEP 6144:9/8JeJfEuGs8k/bUlgqjpJDHCq17WSTLp980sbpy3KR/ie5b2b2YfwHbmdUnmXr8:2JeJfEuGstgg/kjp98zHpie5ym6egr8
- TLSH T1FBE4BF1372E1B1F1D86625F41F679379A7B67C30563AAE0B63D43E1B16314A0AB36323
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Modifies WinLogon for persistence
-
Disables RegEdit via registry modification
-
Disables Task Manager via registry modification
-
Adds Run key to start application
-
Drops desktop.ini file(s)
-
Enumerates connected drives
Attempts to read the root path of hard drives other than the default C: drive.
-
Modifies WinLogon
-
AutoIT Executable
AutoIT scripts compiled to PE executables.
-
Drops file in System32 directory
MITRE ATT&CK Enterprise v16
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
1Winlogon Helper DLL
2