d3938d38fb04a943220a791ea7e95e47cf1bec7add2ab74c083c67741a79d8c6

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Size 1.2MB
Sample260812-aee2bshd79
SHA256 d3938d38fb04a943220a791ea7e95e47cf1bec7add2ab74c083c67741a79d8c6
MD5 2e28eed407d17a8d3bce35dc56edfcb8
SHA1 9f6427edb9c421f62fe47bb41330c38526961459
SHA512 919a58fb5a128deffe8403c3ce642eb188bf7b95c78a5dfbe393f7e08ce3a7a0eec4d317cfe30b1a025e4f9a6c688951c5e0cbbf21d4a01b5201e4d847bb144c
SSDEEP 24576:Xpo/2+ttPJLfpRKzCoSBxEOCcg91TJsoqOnTn:me2PJLazCocyPDJ2sT
TLSH
T11F45C00273D680F1E86238711567E26AA7797D154726CA9BEBE03E379D310B09F2D372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware defense_evasion discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	system3_.exe

Disables RegEdit via registry modification 2 IoCs

defense_evasion

description	ioc	Process
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1"	system3_.exe

Disables Task Manager via registry modification
defense_evasion

Executes dropped EXE 2 IoCs

pid	Process
2728	system3_.exe
5724	system3_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	system3_.exe

AutoIT Executable 5 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/4512-0-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe
behavioral2/files/0x000600000001b86d-7.dat	autoit_exe
behavioral2/memory/5724-10-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe
behavioral2/memory/4512-35-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe
behavioral2/memory/2728-37-0x0000000000400000-0x0000000000514000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
2320	cmd.exe
2428	cmd.exe
2184	cmd.exe
2128	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Key created	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	system3_.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-189034102-168398478-1159367937-1000\Software\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{A8CDFF1C-4878-43be-B5FD-F8091C1C60D0}\Instance\	explorer.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4512	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
4512	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
2728	system3_.exe
2728	system3_.exe
5724	system3_.exe
5724	system3_.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1432	explorer.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4512 wrote to memory of 2128	4512	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe	89
PID 2128 wrote to memory of 2088	2128	cmd.exe	91
PID 4512 wrote to memory of 2320	4512	2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe	92
PID 2320 wrote to memory of 5124	2320	cmd.exe	94
PID 2728 wrote to memory of 2428	2728	system3_.exe	100
PID 1432 wrote to memory of 5724	1432	explorer.exe	103
PID 2428 wrote to memory of 4428	2428	cmd.exe	104
PID 2728 wrote to memory of 2184	2728	system3_.exe	105
PID 2184 wrote to memory of 4296	2184	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_2e28eed407d17a8d3bce35dc56edfcb8_elex_stop.exe"
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4512
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2128
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2088
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2320
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:5124

C:\Windows\explorer.exe
Explorer.exe system3_.exe
1⤵
PID:2612

C:\Users\Admin\Desktop\system3_.exe
C:\Users\Admin\Desktop\system3_.exe
1⤵
- Modifies WinLogon for persistence
- Disables RegEdit via registry modification
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2428
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4428
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2184
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4296

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1432
- C:\Users\Admin\Desktop\system3_.exe
  "C:\Users\Admin\Desktop\system3_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:5724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37996DB9BB614EAA7D6117AAB3E0F7C9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\37996DB9BB614EAA7D6117AAB3E0F7C9
Size 420B
SHA256 18f808038293a4cc4ebefd914a3f5ca422ff8fd2d99032a90db07ace8a2e3b3b
MD5 1f26ebed7a39dd9122c51f1dfbc35a03
SHA1 286b3937b3baa7a4e23c1f1bf555d7d5855354ac
SHA512 864762d3f4d25ef756e695f0c07bdb3989d1153f74ffd708a0eb8451e8741294499bf4830e0da16246d6196c5fe79a4c1fc4a204bc4ac9b5580e7e10d8548971
TLSH
T15CE0DC66697D23914AE0E910C1C8C09F2CF88086191E24001A358AA18192B4EE9123CD
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 63b14543360f5e89942ea8d5113526e64fbc71c1207328f0136b3a495d921dd0
MD5 adac67e1d2da2d706db151c2db316b2d
SHA1 5f6e301d23e33132209707945d0e740d5bcb8996
SHA512 9371b62ac25c6ea8fb6fca19ac47b873ced9b3d0cb45ce4de5ea974b93c12684c65aa23c7d83331c77502853258a08dff73ce5e3fb6170bd3ab1c5b3283a86a9
TLSH
T1DE31AD4EA2153027D5427F72D8CEBE83CEB1364667CAD46B18046E4229AAFC25FC80C9
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

37996DB9BB614EAA7D6117AAB3E0F7C9

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\37996DB9BB614EAA7D6117AAB3E0F7C9
Size 192B
SHA256 3f5efd7c2f5928ddf5293a53ca0f435e83f3d5dd8c68f9779355c9fbc9dd9a8a
MD5 4a77f20316158adf8d996282b912a31a
SHA1 af5e376f91d0de66dce5dab577093e6106f77a11
SHA512 fbaeb3bb3630a652d476ea594166a61b6d9e313df6ec9ac8bd1ecd2689b252de8ddaf098b8f76ee4dc3d424e0f13205389d5554a6b07aba56a6bc659bc91cec7
TLSH
T14AC08C003E220200E145123E99A1A7080BBAE118C273A31A5BB80238480A9C52C30E08
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 4b6569972e0268a53e8e578301b393e38e0142ac6bff2d6f96e074899f7b8e3e
MD5 648aa692f5c156221620bc37dfa6c51a
SHA1 a4e5e4c6f684689976a639995e9d440b2b190c8d
SHA512 9b9c310a04acfd39bdfe7eb8359411afda71ffefa60b864b210ee1076e7056d366d26b2238d0970a45e5a900f7a604837c623182797cc8b601329dc5c4730acf
TLSH
T138C04C1837B54156F1304D7F1A52635547BAE5058D4183541F645269C51DA435CE5D06
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 437cfd376e2cd806b3a38717f93a17c6ca2bb52be7cfcf3923264196b228fd45
MD5 621c76e1a08bf208009afb41d5444802
SHA1 900237937ff69b5fde5a10b00910c029186dccc0
SHA512 560ff26f6dbdfb52083f3fdc1e59caf40eef9e78ecdb616ae821b0ea84676f31c9a46882d5b2f0b1ef0529f79b195aa6926754d5a2ea226b918e39bc4b31c623
TLSH
T11DC09214B3A9471AF50E253EBDE66A041BBA864AF6DAC3045FB81238C928A410CB2D09
MD5 SHA1 SHA512 TLSH

Submit Download

setting[1].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\Y3NYWQ12\setting[1].htm
Size 173B
SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
MD5 bcd560eba80b849c980a5123047bc8f8
SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b
TLSH
T176C0806D6B533C9874973B3950C39160E1DC503023D9041112704507F0CB1D78DC23D1
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.ini

Path C:\Users\Admin\Desktop\autorun.ini
Size 102B
SHA256 94a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
MD5 948c74cd98911b420ff89dac13399bcb
SHA1 76dfc73518f003953923b1b4f2b973f4bb56a411
SHA512 b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
TLSH
T1F3B01221E3BC0950040CF48CC3800CF2F023BD401008090372E1584C838000E573FC78
MD5 SHA1 SHA512 TLSH

Submit Download

system3_.exe

Path C:\Users\Admin\Desktop\system3_.exe
Size 1.2MB
SHA256 d3938d38fb04a943220a791ea7e95e47cf1bec7add2ab74c083c67741a79d8c6
MD5 2e28eed407d17a8d3bce35dc56edfcb8
SHA1 9f6427edb9c421f62fe47bb41330c38526961459
SHA512 919a58fb5a128deffe8403c3ce642eb188bf7b95c78a5dfbe393f7e08ce3a7a0eec4d317cfe30b1a025e4f9a6c688951c5e0cbbf21d4a01b5201e4d847bb144c
SSDEEP 24576:Xpo/2+ttPJLfpRKzCoSBxEOCcg91TJsoqOnTn:me2PJLazCocyPDJ2sT
TLSH
T11F45C00273D680F1E86238711567E26AA7797D154726CA9BEBE03E379D310B09F2D372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2728-37-0x0000000000400000-0x0000000000514000-memory.dmp

Download

memory/4512-0-0x0000000000400000-0x0000000000514000-memory.dmp

Download

memory/4512-1-0x000000000047D000-0x000000000047E000-memory.dmp

Download

memory/4512-35-0x0000000000400000-0x0000000000514000-memory.dmp

Download

memory/5724-10-0x0000000000400000-0x0000000000514000-memory.dmp

Download