d2ee6c424bf11c946e3d86f24fbaf1b92f7f0a87ce74fc31eea56991089159be

Analysis

max time kernel
149s
max time network
141s
platform
windows10-2004_x64
resource
win10v2004-20260911-en
resource tags

arch:x64arch:x86image:win10v2004-20260911-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/09/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Size 791KB
Sample260916-wpthcsstc1
SHA256 d2ee6c424bf11c946e3d86f24fbaf1b92f7f0a87ce74fc31eea56991089159be
MD5 af7433de38d4263b8dc389099f0e0c13
SHA1 c55d67d4fd13b6d5a4ef21da791a1d5041356f08
SHA512 a3129542a7b7fcb2097f15744a094b08769d8be218f20561041e0eddd63c9a723b7fef5c75f0554d6808e68a9253ed9b39728a8e1e0287246bc0b82485ee9fae
SSDEEP 6144:3pqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCm:3pqiC/2OGAtkCP4cejGSOpRK3CnIiG
TLSH
T1B4058E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

adware discovery execution persistence spyware stealer

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 2 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe system3_.exe"	system3_.exe

Executes dropped EXE 2 IoCs

pid	Process
2464	system3_.exe
2820	system3_.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yahoo Messengger = "C:\\Users\\Admin\\Desktop\\system3_.exe"	system3_.exe

AutoIT Executable 6 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral1/memory/4240-0-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe
behavioral1/files/0x00080000000004e9-11.dat	autoit_exe
behavioral1/memory/2820-25-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe
behavioral1/memory/2820-27-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe
behavioral1/memory/4240-41-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe
behavioral1/memory/2464-44-0x0000000000400000-0x00000000004DC000-memory.dmp	autoit_exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Executes a command shell one-liner 1 TTPs 4 IoCs

Execution of a cmd.exe one-liner (/c "close" or /k "keep") is a common script/loader stage.

execution

Windows Command Shell

T1059.003

pid	Process
4576	cmd.exe
3036	cmd.exe
988	cmd.exe
4680	cmd.exe

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	at.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	system3_.exe

Modifies Internet Explorer settings 1 TTPs 10 IoCs

adware spyware

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.advgoogle.blogdpot.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Search Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	system3_.exe
Key created	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\Software\Microsoft\Internet Explorer\Main	system3_.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Page_URL = "http://www.advgoogle.blogdpot.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Default_Search_URL = "http://www.advgoogle.blogdpot.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe

Modifies Internet Explorer start page 1 TTPs 4 IoCs

stealer

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.advgoogle.blogdpot.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.advgoogle.blogdpot.com"	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-240542094-4193773837-3211495583-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Start Page = "http://www.mydreamworld.50webs.com"	system3_.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4240	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
4240	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
2464	system3_.exe
2464	system3_.exe
2820	system3_.exe
2820	system3_.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4240 wrote to memory of 988	4240	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe	86
PID 988 wrote to memory of 4652	988	cmd.exe	89
PID 4240 wrote to memory of 4680	4240	2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe	90
PID 4680 wrote to memory of 3140	4680	cmd.exe	92
PID 2464 wrote to memory of 4576	2464	system3_.exe	99
PID 4576 wrote to memory of 1840	4576	cmd.exe	101
PID 2464 wrote to memory of 3036	2464	system3_.exe	102
PID 516 wrote to memory of 2820	516	explorer.exe	104
PID 3036 wrote to memory of 3288	3036	cmd.exe	106

C:\Users\Admin\AppData\Local\Temp\2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-16_af7433de38d4263b8dc389099f0e0c13_elex_stop.exe"
1⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4240
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:988
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4680
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3140

C:\Windows\explorer.exe
Explorer.exe system3_.exe
1⤵
PID:1720

C:\Users\Admin\Desktop\system3_.exe
C:\Users\Admin\Desktop\system3_.exe
1⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Modifies Internet Explorer start page
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2464
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT /delete /yes
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4576
- - C:\Windows\SysWOW64\at.exe
    AT /delete /yes
    3⤵
    - System Location Discovery: System Language Discovery
    PID:1840
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
  2⤵
  - Executes a command shell one-liner
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3036
- - C:\Windows\SysWOW64\at.exe
    AT 09:00 /interactive /EVERY:m,t,w,th,f,s,su C:\Users\Admin\Desktop\system3_.exe
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3288

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
- Suspicious use of WriteProcessMemory
PID:516
- C:\Users\Admin\Desktop\system3_.exe
  "C:\Users\Admin\Desktop\system3_.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:2820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Windows Command Shell

T1059.003

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 1KB
SHA256 6f7bfa4789bd506ccf81640feec036bac7c0354084ca472f55a79ce53b9c3ade
MD5 b15dfb1600ace7f0c686862d26b733ad
SHA1 3bfa41f3ea756f0377dbc2900736ca74c8d42702
SHA512 3d261c2965f608b6af5490e10522db148140bb73a1332a132742db0d4c78783c93273c594e2465011a2062a043e0027281f6062f90aff584fc603162bd1d79fd
TLSH
T1A831B04EA2053023DA49BF72D8CE7E83CDB0374BABCAD45B19445E4229AAFC25FC40C5
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B46811C17859FFB409CF0E904A4AA8F8
Size 528B
SHA256 d2bb091268ade68ad8121d2184d0fbce128070156304bd4de312e6fbd267409c
MD5 047f3e9d21d6b325d592b1959e4362e6
SHA1 5aeef5f985171cd69da397fd039854e44ebecdd2
SHA512 4523896ed4a03afafd2075d8c8947236d34fe1da2c246a3f90c2be2a5c151c18bc58a6cde5a209abb8e06e80f662e24d0149640b3e98e8a872bfa8a04ef592a4
TLSH
T147F0500990082252C855FF55DFD6AC97DC76336136E595036D458E410C12F96AF950F5
MD5 SHA1 SHA512 TLSH

Submit Download

DB1D8414D7476F1600F87016F0D4E3DD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\DB1D8414D7476F1600F87016F0D4E3DD
Size 308B
SHA256 16f760c48a00d8058b8a52b622b30cb63a37f8eec7ca2ad01bd4ac7bcfaaca8c
MD5 0f9fd1da699bf2960e43cb2355a0e4a4
SHA1 ea305fee7889721b3eb5fcb4e885abadc951eaf9
SHA512 6ef8af1cc5bd0e24e6f6a83ff91aeea085b8915100e5afc67d7ab6bc83cd4183a0bbba2ed92ec17d2e5f92f82e37ec8fb7f99ff1f4b92ce8a47d943ecf068cd3
TLSH
T128E02680B66D26811270E400E8D5C4072CB8A0D99E0D70015950DBD55497AC6E9452C9
MD5 SHA1 SHA512 TLSH

Submit Download

8B2B9A00839EED1DFDCCC3BFC2F5DF12

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8B2B9A00839EED1DFDCCC3BFC2F5DF12
Size 174B
SHA256 dec03fecb2440a0fa1231691fed47a3b2c88e4a9a0d7736a0044045c51d745f9
MD5 d92bced1e9f3a76394584661fb004845
SHA1 3fdd1c5273dbe41d0248c8e4b1f0e2b0bc3e1b67
SHA512 8b9389922b106e2bb832ebfe7099219d722f798fd8fa978096c03c2cb120ba24584940486187dbd0446054bbf0375dd48739e3e118f6e86f7bfa1cb33611c098
TLSH
T101C02B44333003A9F070197F4552C3404FFEC204D84283741F301308801CA024CB0D07
MD5 SHA1 SHA512 TLSH

Submit Download

B46811C17859FFB409CF0E904A4AA8F8

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B46811C17859FFB409CF0E904A4AA8F8
Size 170B
SHA256 c80f4f5f977c3193a9a1324bb1bab2dbb0a4a5aacf24afd0c298f15c801d21c2
MD5 8996826d100b55862457019e17db0c0f
SHA1 eedcf645ae555219c2a0253ecf7d8a71206f2e16
SHA512 0ebcdbb596b0d343072287c67c2199ecf099768939a9903446cda3379620a5cddd8f1ac1082c12343d20547e04ab8929170d57275feb91bd0a00d1a69f366b29
TLSH
T117C09B1473A54757F10D117D79E5160517B95205F5CAC3444BB45134851C6400871D05
MD5 SHA1 SHA512 TLSH

Submit Download

DB1D8414D7476F1600F87016F0D4E3DD

Path C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DB1D8414D7476F1600F87016F0D4E3DD
Size 192B
SHA256 dabd480aeae69cfcc0aaca8e6d478a687d978cc8a771d6d7459f6125a77c5ecf
MD5 f1fe94b7684c43bbcf6ec5db7a15fd81
SHA1 0d05410efaf050ed87d60e0d9de0e658352bba2d
SHA512 d8c945557ce3ed73f487157f8e917aee05d41237084ecd024b157cd054c938a3ecb5a7bf8283e6060d4a7c175f4720460fea61aaa295052c4b10d4ffd70ea981
TLSH
T137C08C283A6A0301F223013D28E19A2243F8A504D1618F4E0BF0023A961E5022C21E04
MD5 SHA1 SHA512 TLSH

Submit Download

setting[3].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\9GMOGYPF\setting[3].htm
Size 173B
SHA256 5bd1cb20b56bb3ea06d9c3f0abe9223a38e93f3d833df496524dcdebfeb3b4ca
MD5 bcd560eba80b849c980a5123047bc8f8
SHA1 cfc17fc5f3743042a8e00ea8d8b2a1e17a739f89
SHA512 1fcc48ff7443592fd8bc612d9625171563bc1c6a31d825fbf1fa888e4102b1ff0616a425f5d59bb7784a671d86bbf0cb637a98be95de8c94a98dfa9a13349a2b
TLSH
T176C0806D6B533C9874973B3950C39160E1DC503023D9041112704507F0CB1D78DC23D1
MD5 SHA1 SHA512 TLSH

Submit Download

setting[2].htm

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\JAXEZ455\setting[2].htm
Size 178B
SHA256 2215b6324712a5453264d05ba2a50d3475a3aca173dfe1bbc46d711722487089
MD5 c423622cf60c65d6aad4acea13b9f447
SHA1 35f82dd6da0f2ec19dc2feb3d02db26266520305
SHA512 4b59628af34c8bed6f7f626a6f229cdf25be59399baf0e792d90f0075ffee94ac969a71de6d57dd481248d7e5bc26b92cc052021a68ede3c37079eb38f93e702
TLSH
T18CC012696B532C9874973A3951C39160E1DC50202299041112604607B08B1A79DC23D5
MD5 SHA1 SHA512 TLSH

Submit Download

autorun.ini

Path C:\Users\Admin\Desktop\autorun.ini
Size 102B
SHA256 94a1ac3d574425ec8a3cc01675e4d787373d2a190dddd4f8ba507c49ca3fd42a
MD5 948c74cd98911b420ff89dac13399bcb
SHA1 76dfc73518f003953923b1b4f2b973f4bb56a411
SHA512 b31d82ede9d48e390a50a9dcf5c4c607c62638e8bc56f473250f9a56b7967d5de948abed69bbb2c35eb0112288faa5c438316b06ccbb36d289e93952b30e2ede
TLSH
T1F3B01221E3BC0950040CF48CC3800CF2F023BD401008090372E1584C838000E573FC78
MD5 SHA1 SHA512 TLSH

Submit Download

system3_.exe

Path C:\Users\Admin\Desktop\system3_.exe
Size 791KB
SHA256 d2ee6c424bf11c946e3d86f24fbaf1b92f7f0a87ce74fc31eea56991089159be
MD5 af7433de38d4263b8dc389099f0e0c13
SHA1 c55d67d4fd13b6d5a4ef21da791a1d5041356f08
SHA512 a3129542a7b7fcb2097f15744a094b08769d8be218f20561041e0eddd63c9a723b7fef5c75f0554d6808e68a9253ed9b39728a8e1e0287246bc0b82485ee9fae
SSDEEP 6144:3pqoa8aLiC/2OLSAN7gNVpNleQUohBfGPOtQciXeL/XYqGlebojSP2pjNhcAYnCm:3pqiC/2OGAtkCP4cejGSOpRK3CnIiG
TLSH
T1B4058E0273D680F1D85238711567E26A9B797D154726CE9BEBE03E339D311B0AF2A372
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2464-44-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/2820-25-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/2820-27-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/4240-41-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/4240-0-0x0000000000400000-0x00000000004DC000-memory.dmp

Download

memory/4240-1-0x000000000047D000-0x000000000047E000-memory.dmp

Download