Analysis
- max time kernel
149s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
26/08/2026, 00:16
Behavioral task
behavioral1
Sample
2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
22 signatures
150 seconds
General
- Target 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe
- Size 3.1MB
- Sample260826-akyqmaxwfs
- SHA256 60353700167edfd1caef187f83530a318f1fccae09928a711e065d5376af8ac4
- MD5 fcefd1051e385d74e4f6385ebf424395
- SHA1 81768a0ec8e4735770fc3c0cbb35b9350d010fcf
- SHA512 bffcbf10f3eb2765e6c984f7c1d52b2a41eb68109338e974279f0525bd0774da609ae07de493b23e3276fafbe81ef7e6c818d60dfc6fc986473869c73851bc08
- SSDEEP 49152:Q3WMvkB3KKQuiBEnmHK+eTL4KydDgXEVg1j15NGAtW6VPPxNjfg1GrC4pM7yOGly:+Wn3KZat34R9OEVSNS6ZrjFrCEM7yZQ
- TLSH T1A9E533845D4DBA32ED116BF23CD95D998A6B7FD0B63BB8F07F5934690433024298887B
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Family: salatstealer
SalatStealer is a stealer that takes sceenshot written in Golang.
- Detect SalatStealer payload 16 IoCs
resource yara_rule behavioral2/memory/1452-1-0x0000000000A90000-0x0000000001618000-memory.dmp family_salatstealer behavioral2/memory/1452-2-0x0000000000A90000-0x0000000001618000-memory.dmp family_salatstealer behavioral2/memory/1452-9-0x0000000000A90000-0x0000000001618000-memory.dmp family_salatstealer behavioral2/memory/4612-11-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-12-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4072-31-0x0000000000A90000-0x0000000001618000-memory.dmp family_salatstealer behavioral2/memory/4612-54-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-57-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-58-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-59-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-61-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-62-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-63-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-66-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-67-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer behavioral2/memory/4612-68-0x00000000005C0000-0x0000000001148000-memory.dmp family_salatstealer - Detect binaries embedding considerable number of cryptocurrency wallet browser extension IDs. 16 IoCs
resource yara_rule behavioral2/memory/1452-1-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1452-2-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/1452-9-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-11-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-12-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4072-31-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-54-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-57-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-58-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-59-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-61-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-62-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-63-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-66-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-67-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs behavioral2/memory/4612-68-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_Embedded_Crypto_Wallet_Browser_Extension_IDs - Detects binaries (Windows and macOS) referencing many web browsers. Observed in information stealers 16 IoCs
resource yara_rule behavioral2/memory/1452-1-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1452-2-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/1452-9-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-11-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-12-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4072-31-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-54-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-57-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-58-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-59-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-61-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-62-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-63-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-66-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-67-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers behavioral2/memory/4612-68-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_Binary_References_Browsers - Detects executables containing SQL queries to confidential data stores. Observed in infostealers 16 IoCs
resource yara_rule behavioral2/memory/1452-1-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1452-2-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/1452-9-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-11-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-12-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4072-31-0x0000000000A90000-0x0000000001618000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-54-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-57-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-58-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-59-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-61-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-62-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-63-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-66-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-67-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore behavioral2/memory/4612-68-0x00000000005C0000-0x0000000001148000-memory.dmp INDICATOR_SUSPICIOUS_EXE_SQLQuery_ConfidentialDataStore - UPX dump on OEP (original entry point) 20 IoCs
resource yara_rule behavioral2/memory/1452-0-0x0000000000A90000-0x0000000001618000-memory.dmp UPX behavioral2/memory/1452-1-0x0000000000A90000-0x0000000001618000-memory.dmp UPX behavioral2/memory/1452-2-0x0000000000A90000-0x0000000001618000-memory.dmp UPX behavioral2/files/0x000d00000001c46e-7.dat UPX behavioral2/memory/1452-9-0x0000000000A90000-0x0000000001618000-memory.dmp UPX behavioral2/memory/4612-10-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-11-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-12-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4072-23-0x0000000000A90000-0x0000000001618000-memory.dmp UPX behavioral2/memory/4072-31-0x0000000000A90000-0x0000000001618000-memory.dmp UPX behavioral2/memory/4612-54-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-57-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-58-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-59-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-61-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-62-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-63-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-66-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-67-0x00000000005C0000-0x0000000001148000-memory.dmp UPX behavioral2/memory/4612-68-0x00000000005C0000-0x0000000001148000-memory.dmp UPX - Badlisted process makes network request 6 IoCs
Network request originating from process or tool commonly abused by malware.
flow pid Process 25 3884 powershell.exe 26 3884 powershell.exe 27 3884 powershell.exe 27 3884 powershell.exe 29 3884 powershell.exe 30 3884 powershell.exe - Executes dropped EXE 2 IoCs
pid Process 4612 WUDFHost.exe 4072 WUDFHost.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Unsecured Credentials: Credentials In Files 1 TTPs
Steal credentials from unsecured files.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\Recovery ReAgentc.exe File opened for modification C:\Windows\SysWOW64\Recovery\ReAgent.xml ReAgentc.exe -
resource yara_rule behavioral2/memory/1452-0-0x0000000000A90000-0x0000000001618000-memory.dmp upx behavioral2/memory/1452-1-0x0000000000A90000-0x0000000001618000-memory.dmp upx behavioral2/memory/1452-2-0x0000000000A90000-0x0000000001618000-memory.dmp upx behavioral2/files/0x000d00000001c46e-7.dat upx behavioral2/memory/1452-9-0x0000000000A90000-0x0000000001618000-memory.dmp upx behavioral2/memory/4612-10-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-11-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-12-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4072-23-0x0000000000A90000-0x0000000001618000-memory.dmp upx behavioral2/memory/4072-31-0x0000000000A90000-0x0000000001618000-memory.dmp upx behavioral2/memory/4612-54-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-57-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-58-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-59-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-61-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-62-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-63-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-66-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-67-0x00000000005C0000-0x0000000001148000-memory.dmp upx behavioral2/memory/4612-68-0x00000000005C0000-0x0000000001148000-memory.dmp upx - Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\MSBuild\51b93e6f-78c1-401d-4d75-1a88b54f6f78 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe File created C:\Program Files (x86)\MSBuild\WUDFHost.exe 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe File created C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe WUDFHost.exe - Drops file in Windows directory 4 IoCs
description ioc Process File opened for modification C:\Windows\Logs\ReAgent\ReAgent.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\setuperr.log ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagerr.xml ReAgentc.exe File opened for modification C:\Windows\Panther\UnattendGC\diagwrn.xml ReAgentc.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUDFHost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ReAgentc.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WUDFHost.exe - Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 1452 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe 1452 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe 1452 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe 1452 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 3884 powershell.exe 4072 WUDFHost.exe 4072 WUDFHost.exe 3884 powershell.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe 4612 WUDFHost.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4612 WUDFHost.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3884 powershell.exe Token: SeDebugPrivilege 4612 WUDFHost.exe Token: SeIncreaseQuotaPrivilege 3884 powershell.exe Token: SeSecurityPrivilege 3884 powershell.exe Token: SeTakeOwnershipPrivilege 3884 powershell.exe Token: SeLoadDriverPrivilege 3884 powershell.exe Token: SeSystemProfilePrivilege 3884 powershell.exe Token: SeSystemtimePrivilege 3884 powershell.exe Token: SeProfSingleProcessPrivilege 3884 powershell.exe Token: SeIncBasePriorityPrivilege 3884 powershell.exe Token: SeCreatePagefilePrivilege 3884 powershell.exe Token: SeBackupPrivilege 3884 powershell.exe Token: SeRestorePrivilege 3884 powershell.exe Token: SeShutdownPrivilege 3884 powershell.exe Token: SeDebugPrivilege 3884 powershell.exe Token: SeSystemEnvironmentPrivilege 3884 powershell.exe Token: SeRemoteShutdownPrivilege 3884 powershell.exe Token: SeUndockPrivilege 3884 powershell.exe Token: SeManageVolumePrivilege 3884 powershell.exe Token: 33 3884 powershell.exe Token: 34 3884 powershell.exe Token: 35 3884 powershell.exe Token: 36 3884 powershell.exe Token: SeIncreaseQuotaPrivilege 3884 powershell.exe Token: SeSecurityPrivilege 3884 powershell.exe Token: SeTakeOwnershipPrivilege 3884 powershell.exe Token: SeLoadDriverPrivilege 3884 powershell.exe Token: SeSystemProfilePrivilege 3884 powershell.exe Token: SeSystemtimePrivilege 3884 powershell.exe Token: SeProfSingleProcessPrivilege 3884 powershell.exe Token: SeIncBasePriorityPrivilege 3884 powershell.exe Token: SeCreatePagefilePrivilege 3884 powershell.exe Token: SeBackupPrivilege 3884 powershell.exe Token: SeRestorePrivilege 3884 powershell.exe Token: SeShutdownPrivilege 3884 powershell.exe Token: SeDebugPrivilege 3884 powershell.exe Token: SeSystemEnvironmentPrivilege 3884 powershell.exe Token: SeRemoteShutdownPrivilege 3884 powershell.exe Token: SeUndockPrivilege 3884 powershell.exe Token: SeManageVolumePrivilege 3884 powershell.exe Token: 33 3884 powershell.exe Token: 34 3884 powershell.exe Token: 35 3884 powershell.exe Token: 36 3884 powershell.exe Token: SeIncreaseQuotaPrivilege 3884 powershell.exe Token: SeSecurityPrivilege 3884 powershell.exe Token: SeTakeOwnershipPrivilege 3884 powershell.exe Token: SeLoadDriverPrivilege 3884 powershell.exe Token: SeSystemProfilePrivilege 3884 powershell.exe Token: SeSystemtimePrivilege 3884 powershell.exe Token: SeProfSingleProcessPrivilege 3884 powershell.exe Token: SeIncBasePriorityPrivilege 3884 powershell.exe Token: SeCreatePagefilePrivilege 3884 powershell.exe Token: SeBackupPrivilege 3884 powershell.exe Token: SeRestorePrivilege 3884 powershell.exe Token: SeShutdownPrivilege 3884 powershell.exe Token: SeDebugPrivilege 3884 powershell.exe Token: SeSystemEnvironmentPrivilege 3884 powershell.exe Token: SeRemoteShutdownPrivilege 3884 powershell.exe Token: SeUndockPrivilege 3884 powershell.exe Token: SeManageVolumePrivilege 3884 powershell.exe Token: 33 3884 powershell.exe Token: 34 3884 powershell.exe Token: 35 3884 powershell.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1452 wrote to memory of 4612 1452 2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe 90 PID 4612 wrote to memory of 3884 4612 WUDFHost.exe 92 PID 4612 wrote to memory of 4072 4612 WUDFHost.exe 94 PID 3884 wrote to memory of 4756 3884 powershell.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-25_fcefd1051e385d74e4f6385ebf424395_elex_hive.exe"1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files (x86)\MSBuild\WUDFHost.exe"C:\Program Files (x86)\MSBuild\WUDFHost.exe"2⤵
- Executes dropped EXE
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4612 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell.exe3⤵
- Badlisted process makes network request
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3884 -
C:\Windows\SysWOW64\ReAgentc.exe"C:\Windows\system32\ReAgentc.exe" /disable4⤵
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
PID:4756
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe"C:\Program Files (x86)\Microsoft\Edge\Application\WUDFHost.exe" -3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:4072
-
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"C:\Program Files (x86)\Microsoft\Edge\Application\139.0.3405.125\elevation_service.exe"1⤵PID:1300
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p -s BDESVC1⤵PID:812
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\MSBuild\WUDFHost.exe
- Size 3.1MB
- SHA256 60353700167edfd1caef187f83530a318f1fccae09928a711e065d5376af8ac4
- MD5 fcefd1051e385d74e4f6385ebf424395
- SHA1 81768a0ec8e4735770fc3c0cbb35b9350d010fcf
- SHA512 bffcbf10f3eb2765e6c984f7c1d52b2a41eb68109338e974279f0525bd0774da609ae07de493b23e3276fafbe81ef7e6c818d60dfc6fc986473869c73851bc08
- SSDEEP 49152:Q3WMvkB3KKQuiBEnmHK+eTL4KydDgXEVg1j15NGAtW6VPPxNjfg1GrC4pM7yOGly:+Wn3KZat34R9OEVSNS6ZrjFrCEM7yZQ
- TLSH T1A9E533845D4DBA32ED116BF23CD95D998A6B7FD0B63BB8F07F5934690433024298887B
- MD5 SHA1 SHA512 SSDEEP TLSH