Analysis
- max time kernel
149s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
05/09/2026, 04:16
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-09-04_8a7d9b58c87d3d684c42420aaa77a53e_amadey_elex_stop.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-09-04_8a7d9b58c87d3d684c42420aaa77a53e_amadey_elex_stop.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
8 signatures
150 seconds
General
- Target 2026-09-04_8a7d9b58c87d3d684c42420aaa77a53e_amadey_elex_stop.exe
- Size 301KB
- Sample260905-ev2bqatset
- SHA256 a182dc57c7b126e7c0b00275bd3a430f702f01e244d4dabdd154e17ff2167c34
- MD5 8a7d9b58c87d3d684c42420aaa77a53e
- SHA1 41983f7ba4750d71456b3c76c90f55bc244d6355
- SHA512 476ccf3e8c48d6be8aa0c3710b78a11aaeec59905e948e73f1bcc6aebe59843450b2ab53ce867528be1edd71907a1d06e16494c844a8d57ac90f9f68a5e1aca1
- SSDEEP 6144:9r1o12lUr7EbaK1fw9mdo7DZJ/wDAUZlYm3UhM9lZ:9rC1ZobTw9tDZJwDrPYmOO
- TLSH T102648C1177D0C032C09629318666C7B68EBFB8756F2595CBBBD41A799F203D2EA3530E
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2996 Tcpview.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-09-04_8a7d9b58c87d3d684c42420aaa77a53e_amadey_elex_stop.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Tcpview.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \Registry\Machine\HARDWARE\DESCRIPTION\System\CentralProcessor\0 Tcpview.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz Tcpview.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe 2996 Tcpview.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2996 Tcpview.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2996 Tcpview.exe - Suspicious use of WriteProcessMemory 1 IoCs
description pid Process procid_target PID 4708 wrote to memory of 2996 4708 2026-09-04_8a7d9b58c87d3d684c42420aaa77a53e_amadey_elex_stop.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-09-04_8a7d9b58c87d3d684c42420aaa77a53e_amadey_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-09-04_8a7d9b58c87d3d684c42420aaa77a53e_amadey_elex_stop.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Users\Admin\AppData\Local\Temp\eW_1033.tmp\Tcpview.exeC:\Users\Admin\AppData\Local\Temp\eW_1033.tmp\Tcpview.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:2996
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\eW_1033.tmp\Tcpview.exe
- Size 293KB
- SHA256 c00d90c50a5e05d270b796645d5f12dee94a31ca94b8ddc90c91af1f9e208850
- MD5 9aa5a93712c584acdcaa7eef9d25ef4d
- SHA1 9589b7b51791c5bb819cbee9f85d49249602768a
- SHA512 21b4c6b7e16cdc3e729fb708b5e9bded3386dbf6bdb8f286bd4ae8e9f0f59f935674730b96eca2d266e648a7badf3973e1a9ae9d365adad2fc24816de98a8e9a
- SSDEEP 6144:51o12lUr7EbaK1fw9mdo7DZJ/wDAUZlYm3UhM9lY:5C1ZobTw9tDZJwDrPYmOf
- TLSH T1FF548D1177D0C032C09629319626C7B68EBFB4356B2599CBBBD41AB99F203D2EB3534D
- MD5 SHA1 SHA512 SSDEEP TLSH