Analysis
- max time kernel
164s - max time network
135s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
25/08/2026, 09:48
General
- Target 2026-08-24_7ad9cc2524be9f55884cd7627cf03bc1_elex_mespinoza.exe
- Size 13.9MB
- Sample260825-ls4gmazeja
- SHA256 c363d9509a7bb81aa26199c7c3aa2ae35f8e0962d1b6b6c36fb9481364d3e460
Malware Config
Signatures
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_7ad9cc2524be9f55884cd7627cf03bc1_elex_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_7ad9cc2524be9f55884cd7627cf03bc1_elex_mespinoza.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2026-08-24_7ad9cc2524be9f55884cd7627cf03bc1_elex_mespinoza.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-24_7ad9cc2524be9f55884cd7627cf03bc1_elex_mespinoza.exe" -uac2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
memory/880-31-0x0000000000400000-0x0000000003023000-memory.dmp
memory/880-32-0x0000000000400000-0x0000000003023000-memory.dmp
memory/1752-29-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-27-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-7-0x00000000060A0000-0x00000000060A1000-memory.dmp
memory/1752-6-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/1752-5-0x00000000051D0000-0x00000000051D1000-memory.dmp
memory/1752-4-0x0000000005070000-0x0000000005071000-memory.dmp
memory/1752-3-0x0000000005050000-0x0000000005051000-memory.dmp
memory/1752-2-0x00000000051B0000-0x00000000051B1000-memory.dmp
memory/1752-1-0x00000000051A0000-0x00000000051A1000-memory.dmp
memory/1752-11-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-14-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-15-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-19-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-26-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-8-0x0000000006090000-0x0000000006091000-memory.dmp
memory/1752-0-0x0000000000400000-0x0000000003023000-memory.dmp
memory/1752-20-0x0000000000400000-0x0000000003023000-memory.dmp
memory/1752-30-0x0000000004FB0000-0x0000000005010000-memory.dmp
memory/1752-28-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-25-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-24-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-23-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-22-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-21-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-18-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-17-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-16-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-13-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-12-0x0000000006090000-0x0000000006110000-memory.dmp
memory/1752-9-0x00000000062C0000-0x00000000062C1000-memory.dmp
memory/1752-10-0x0000000004FB0000-0x0000000005010000-memory.dmp