Analysis
- max time kernel
148s - max time network
115s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
15/08/2026, 03:32
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe
Resource
win10v2004-20260513-en
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe
Resource
win11ltsc2024-20260709-en
4 signatures
150 seconds
General
- Target 2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe
- Size 1.8MB
- Sample260815-d3tfeadf48
- SHA256 f8407fefd1cd66003cb8b2ee17049e84141f76c72d1fde5fc971d12a9ea4da2a
- MD5 92fb20dc85b523199a44529f176127e1
- SHA1 dcf02f630540411818ccc37fa869cac68a126c38
- SHA512 e663c94082bc4fd91237897bc06de2e84cc71327bc0e8fa5a1721f84bb512a5463a1bcc0a8d5cd4ed8419c7693558bb9624b8d4c067611e47017fc6efb004942
- SSDEEP 49152:J17Xac1GPBThAVYshi/uHP8EkNxxt/sjwahOljxun:m0GPBThAVbP/kNxxt/skahOin
- TLSH T170958E217AD1C07AC233353185DE9279B6B6AF705B3542C766902E397E341C3A938B7B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 4220 2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe 4220 2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe 4220 2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe 4220 2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4220 2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe 4220 2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-15_92fb20dc85b523199a44529f176127e1_elex_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
PID:4220
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\SettingFiles\Settings\Image\Exit.bmp
- Size 824B
- SHA256 22b9bfec4e1b27b6aedd4d754e1b282a5f76b7d47f4a9484c956b164c0a1e424
- MD5 8f10112a202ddbc0fb796ddb8028152e
- SHA1 264b13590840d8aa3a9e576c2cf491e640f54747
- SHA512 e2f14893c0dd690e6178e0a486c402850806ce62e4d1b623e73995bc1de3835d76ac1eeb30dbe4ee173b4c87130855fdf749fe80bad72dac5875810fa60e78d5
- TLSH T11E019EB0AF4012B8CFF458B119508D2B918B7F3F4946660F495EF0A109791F5DF425E7
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SettingFiles\Settings\Image\Exit_mo.bmp
- Size 824B
- SHA256 6ce1271d7b12068bcbd98ce7e039ee7a3eaae478648fabe57c4a0217d5ce5b68
- MD5 bf34cb80fd944096a04319f1732b355f
- SHA1 72060da05f01371473991dda74eaf2cf65c56bdb
- SHA512 86847e1917759ae4e94c9769d79ff3b21749cd33ece4b7fdc805218fa6bc863dfe8eb0d439183ca50637bec9b7dd6d686bfe1f3b23d99ce80da482a616f24822
- TLSH T112019504D4899479FC693478F4008DD754AB57B74069894F4AAACDD150331F8C969CAF
- MD5 SHA1 SHA512 TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SettingFiles\Settings\Image\background.bmp
- Size 496KB
- SHA256 ea0c7cc3a492618d8b3366cbbb7a5b360480cfcf347485fd4335d1c1af312929
- MD5 a4164e43fd542b973d6e7fd70a032e72
- SHA1 46872c979973434be07f3c5183364ebd0cf7dc33
- SHA512 2f776722a32b950f19c72722a26054cfc188b4bccd4dc8bc46ba366d1ab7f27d494b90127f84b8c21a35dd0217bbba0559b564fe607f3320d59febab0a16c584
- SSDEEP 768:7HnHeq0otA/Uh6q83TDOVd0ch9qgHU/QNE3:UotgTDMG
- TLSH T1A2B46DE7F786E7ABE5645E72F41A2B14DA91AE6010C7D33B667EF0A844F435430D3A02
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SettingFiles\Settings\Image\start.bmp
- Size 22KB
- SHA256 d7352834586d7c48d55e9dd6b4959f305670ad3027c90cb000ca4780aee48dfb
- MD5 67e40d1afb1d384ef00e845c9947bc76
- SHA1 dc43b215fc550f045165cc6e63a8d615b82c6054
- SHA512 1356328fbf2680090b2ebe76941ed942fb92f497014a383d79e7c37809a26b3e5523720297c39fdac2176e7f0151f3becb1e5138352ca8d11478dd8b19b07271
- SSDEEP 192:sWkbX6HAARARPPPPXPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPPD:sWkbXqAARA9S8KOXo6YZTCya
- TLSH T1EFA2EE36F1EF65B98A3ED3B9C189D0549C3584D0E8BA071D2EE8DF71E0A5982FE4142D
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SettingFiles\Settings\Image\start_d.bmp
- Size 22KB
- SHA256 ccc93644dbd5f513238532b204e3c800349871e10a84da52db42d4554162804f
- MD5 0c99c557f952341b7569a12f3e083070
- SHA1 956d823d435ccebfd63359389f2dbb0314ab092e
- SHA512 bf9d5d39415fe5820ecb64b678c92f629f088a3dac31bb35ecf8b3135656440cb1057c7c5dc8fdc2cd8ed6f2ae450a5a298d05c23b10d7fecae1ba9efe318e9a
- SSDEEP 96:sTEDBCV3vMSiEqE7uDubY60QPAyZJIV5VkITT4oS:sVsHkAyc4oS
- TLSH T138A20D0068285DCDF3A373AC3EDA7665459AC1447218363F79069A60AF77A04343EFBE
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SettingFiles\Settings\Image\start_mo.bmp
- Size 22KB
- SHA256 dabf1dce4f0c3fe19e848d2d08a93f4765bf6d895b4be4b61cc280eb68da470e
- MD5 d896e3a87a54e66b2679bed35938e629
- SHA1 349f770312113006ee761289f47ea032b05c6f74
- SHA512 b712df9aaed1a27a9a6e509d7216530fc3594b6de9a0319bd4c9f52e674d7ba978894ff9537a02ccdec3e1d9887628a99f2bbae9145464df9d653e3ed43fc657
- SSDEEP 192:sV37mxOOOOOOOOOz6OOOOOOjOOOOeZuyIyyyyTnWyycalIWcIIIILkUGsKWJfaM0:sxoyIyyyyjSlIWcIIIIAUrK
- TLSH T11FA2ADCCCF80B5FAF8249876D6097B8E5668A1D6734352FD3727C66C85EB0488D472B8
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\SettingFiles\Settings\UISettings.ini
- Size 1KB
- SHA256 6a56fffbb762e961f2bd4acf4299597767e0ccc0cb26ad13b4b61a5a1ab590f1
- MD5 b1bec163d4cc86c20797bbe9f71ac015
- SHA1 9e8c3a07b3264ec95c8f9129f3f6982a5fc2953c
- SHA512 1a6397657bc87452f589482ee6b33ba03adaf14d852feb44c95f1aba59869e5fb3ccf683ba0891f1dd1bb736b6b03d55c32713ff7651f26de5fe3bb6c09afcb4
- TLSH T17C41941B2BFD0059B5B3EB88C6F154B65F26F5662A2D8D7C44E2024A04F3D4179237E7
- MD5 SHA1 SHA512 TLSH