1e53c43533d777970dc15332f26e6162a1e87e9a457cd7226657060bc7799b48

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/08/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-22_106db271bb5a396cfc441036ffbf6059_elex_stop.exe
Size 111KB
Sample260823-prn74aab98
SHA256 1e53c43533d777970dc15332f26e6162a1e87e9a457cd7226657060bc7799b48
MD5 106db271bb5a396cfc441036ffbf6059
SHA1 1477ec795f35bace545343dac49669661d1437c4
SHA512 f398e2743a994cb1076bbbabc436b996083809b1498383a42e686b9ea50a3bfc6cfcfa1e97f02fd097a3e60e32fa3915f3eb090365c9efbcf3811818649392d5
SSDEEP 1536:juDwA2oF0c8Sej7ypV/scL//v4ce7XxI+7GupfjlgUCgirgN:jswA20lMjyVUcL/X2FI+HBlBWrm
TLSH
T1FCB35B10A2418065E79A1775419AF6F18E685F3D1399E5CFE3747E32AE312E3AA3304F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4132	1548	WerFault.exe	88

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-22_106db271bb5a396cfc441036ffbf6059_elex_stop.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-22_106db271bb5a396cfc441036ffbf6059_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-22_106db271bb5a396cfc441036ffbf6059_elex_stop.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1548
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1548 -s 256
  2⤵
  - Program crash
  PID:4132

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 1548 -ip 1548
1⤵
PID:2276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1548-0-0x0000000000500000-0x0000000000588000-memory.dmp

Download