d3938d38fb04a943220a791ea7e95e47cf1bec7add2ab74c083c67741a79d8c6

General

Target
2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Size 1.2MB
Sample260812-aee2bshd79
SHA256 d3938d38fb04a943220a791ea7e95e47cf1bec7add2ab74c083c67741a79d8c6
MD5 2e28eed407d17a8d3bce35dc56edfcb8
SHA1 9f6427edb9c421f62fe47bb41330c38526961459
SHA512 919a58fb5a128deffe8403c3ce642eb188bf7b95c78a5dfbe393f7e08ce3a7a0eec4d317cfe30b1a025e4f9a6c688951c5e0cbbf21d4a01b5201e4d847bb144c
SSDEEP 24576:Xpo/2+ttPJLfpRKzCoSBxEOCcg91TJsoqOnTn:me2PJLazCocyPDJ2sT
TLSH
T11F45C00273D680F1E86238711567E26AA7797D154726CA9BEBE03E379D310B09F2D372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	system3_.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system3_.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 2 IoCs

pid	Process
3636	system3_.exe
1352	system3_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	system3_.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/4708-0-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe
behavioral1/files/0x000e0000000231e4-11.dat	autoit_exe
behavioral1/memory/3636-13-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe
behavioral1/memory/1352-17-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe
behavioral1/memory/4708-21-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe
behavioral1/memory/3636-22-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4612	cmd.exe
5620	cmd.exe
4104	cmd.exe
5588	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	system3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Software\Microsoft\Internet Explorer\Main	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4708	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
4708	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
3636	system3_.exe
3636	system3_.exe
1352	system3_.exe
1352	system3_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4708 wrote to memory of 4612	4708	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe	87
PID 4612 wrote to memory of 5204	4612	cmd.exe	89
PID 4708 wrote to memory of 5620	4708	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe	90
PID 5620 wrote to memory of 2496	5620	cmd.exe	92
PID 3636 wrote to memory of 4104	3636	system3_.exe	98
PID 4104 wrote to memory of 5720	4104	cmd.exe	100
PID 3636 wrote to memory of 5588	3636	system3_.exe	101
PID 5588 wrote to memory of 3944	5588	cmd.exe	104
PID 3988 wrote to memory of 1352	3988	explorer.exe	105

C:\Users\Admin\AppData\Local\Temp\2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4708
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4612
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5204
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5620
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2496

C:\Windows\explorer.exe
Explorer.exe system3_.exe
1⤵
PID:2388

C:\Users\Admin\Desktop\system3_.exe
C:\Users\Admin\Desktop\system3_.exe
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4104
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5720
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:5588
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3944

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:3988
- C:\Users\Admin\Desktop\system3_.exe
  "C:\Users\Admin\Desktop\system3_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:1352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Windows Command Shell

1

T1059.003

Persistence

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

2

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Winlogon Helper DLL

1

T1547.004

Defense Evasion

Modify Registry

4

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

autorun.ini

Path C:\Users\Admin\Desktop\autorun.ini
Size 102B
SHA256 94a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
MD5 948c74cd98911b420ff89dac13399bcb
SHA1 76dfc73518f003953923b1b4f2b973f4bb56a411
SHA512 b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
TLSH
T1F3B01221E3BC0950040CF48CC3800CF2F023BD401008090372E1584C838000E573FC78
MD5 SHA1 SHA512 TLSH

Submit Download

system3_.exe

Path C:\Users\Admin\Desktop\system3_.exe
Size 1.2MB
SHA256 d3938d38fb04a943220a791ea7e95e47cf1bec7add2ab74c083c67741a79d8c6
MD5 2e28eed407d17a8d3bce35dc56edfcb8
SHA1 9f6427edb9c421f62fe47bb41330c38526961459
SHA512 919a58fb5a128deffe8403c3ce642eb188bf7b95c78a5dfbe393f7e08ce3a7a0eec4d317cfe30b1a025e4f9a6c688951c5e0cbbf21d4a01b5201e4d847bb144c
SSDEEP 24576:Xpo/2+ttPJLfpRKzCoSBxEOCcg91TJsoqOnTn:me2PJLazCocyPDJ2sT
TLSH
T11F45C00273D680F1E86238711567E26AA7797D154726CA9BEBE03E379D310B09F2D372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1352-17-0x0000000000400000-0x0000000000514000-memory.dmp

Download

memory/3636-13-0x0000000000400000-0x0000000000514000-memory.dmp

Download

memory/3636-22-0x0000000000400000-0x0000000000514000-memory.dmp

Download

memory/4708-0-0x0000000000400000-0x0000000000514000-memory.dmp

Download

memory/4708-1-0x000000000047D000-0x000000000047E000-memory.dmp

Download

memory/4708-21-0x0000000000400000-0x0000000000514000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads