knight_logger | d93f8153e7767f5f4b773e31b743ad01157517c2247929065fee98a291988be6

Analysis

max time kernel
103s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
Size 2.6MB
Sample261002-l4emmsvgmf
SHA256 d93f8153e7767f5f4b773e31b743ad01157517c2247929065fee98a291988be6
MD5 849b89768888a8fcc3970b10721c1cbe
SHA1 e100e5565f0f314dae2b065831608da749ae6379
SHA512 763e4904f42049bd1eed0b47c9372820d25cec1a3149f9ddc8bbef9500a098658b20df131c4185e228b12fd308eb90696a58b57b059f0633184eb6aa27e5316e
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4er:ObCjPKNqQEfsw43qtmVfq4o
TLSH
T148C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

10^/10

defense_evasion discovery execution knight_logger persistence spyware stealer upx

Malware Config

Extracted

Credentials

Protocol
smtp
Host
smtp.mail.me.com
Port
587
Username
[email protected]
Password
RICHARD205lord

Signatures

Family: KnightLogger
KnightLogger is a Windows stealer written in C#.
stealer knight_logger

Detects executables packed with MEW 1 IoCs

resource	yara_rule
behavioral2/memory/3836-27-0x0000000000400000-0x000000000043C000-memory.dmp	INDICATOR_EXE_Packed_MEW

UPX dump on OEP (original entry point) 2 IoCs

resource	yara_rule
behavioral2/memory/3848-19-0x0000000000400000-0x000000000048E000-memory.dmp	UPX
behavioral2/memory/588-25-0x0000000000400000-0x0000000000491000-memory.dmp	UPX

Executes dropped EXE 3 IoCs

pid	Process
1980	jhdfkldfhndfkjdfnbfklfnf.exe
4248	winmgr119.exe
3180	winmgr119.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe"	2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-1404337215-1550464601-2805570857-1000\Software\Microsoft\Windows\CurrentVersion\Run\jhdfkldfhndfkjdfnbfklfnf = "C:\\ProgramData\\jhdfkldfhndfkjdfnbfklfnf.exe"	jhdfkldfhndfkjdfnbfklfnf.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 TTPs 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

discovery

Internet Connection Discovery

T1016.001

flow	ioc
1	ipinfo.io
1	icanhazip.com

AutoIT Executable 3 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/files/0x000d00000001c563-4.dat	autoit_exe
behavioral2/files/0x000c00000001c565-5.dat	autoit_exe
behavioral2/files/0x000c00000001c568-12.dat	autoit_exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 1980 set thread context of 4296	1980	jhdfkldfhndfkjdfnbfklfnf.exe	91
PID 4296 set thread context of 3848	4296	RegAsm.exe	96
PID 4296 set thread context of 588	4296	RegAsm.exe	97
PID 4296 set thread context of 3836	4296	RegAsm.exe	98

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3848-19-0x0000000000400000-0x000000000048E000-memory.dmp	upx
behavioral2/memory/588-25-0x0000000000400000-0x0000000000491000-memory.dmp	upx

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 4 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe:Zone.Identifier:$DATA	2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
File created	C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA	jhdfkldfhndfkjdfnbfklfnf.exe
File created	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe
File opened for modification	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs

The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.

discovery

System Network Configuration Discovery

T1016

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Domain	RegAsm.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Tcpip\Parameters\Hostname	RegAsm.exe

System Location Discovery: System Language Discovery 1 TTPs 20 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	winmgr119.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	jhdfkldfhndfkjdfnbfklfnf.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

NTFS ADS 4 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Local\Temp\2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe:Zone.Identifier:$DATA	2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
File created	C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe:Zone.Identifier:$DATA	jhdfkldfhndfkjdfnbfklfnf.exe
File created	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe
File opened for modification	C:\ProgramData\winmgr119.exe:Zone.Identifier:$DATA	winmgr119.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 24 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
3236	schtasks.exe
5184	schtasks.exe
1496	schtasks.exe
1560	schtasks.exe
2276	schtasks.exe
2336	schtasks.exe
2248	schtasks.exe
1200	schtasks.exe
5220	schtasks.exe
3552	schtasks.exe
2704	schtasks.exe
3240	schtasks.exe
4588	schtasks.exe
2696	schtasks.exe
1432	schtasks.exe
4548	schtasks.exe
4716	schtasks.exe
3968	schtasks.exe
5692	schtasks.exe
5552	schtasks.exe
1548	schtasks.exe
1700	schtasks.exe
2828	schtasks.exe
4888	schtasks.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
5400	2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
5400	2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
4248	winmgr119.exe
4248	winmgr119.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
3180	winmgr119.exe
3180	winmgr119.exe
4296	RegAsm.exe
4296	RegAsm.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
4296	RegAsm.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
4296	RegAsm.exe
4296	RegAsm.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe
1980	jhdfkldfhndfkjdfnbfklfnf.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	4296	RegAsm.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4296	RegAsm.exe

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 5400 wrote to memory of 1980	5400	2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe	89
PID 1980 wrote to memory of 4296	1980	jhdfkldfhndfkjdfnbfklfnf.exe	91
PID 1980 wrote to memory of 4296	1980	jhdfkldfhndfkjdfnbfklfnf.exe	91
PID 1980 wrote to memory of 4296	1980	jhdfkldfhndfkjdfnbfklfnf.exe	91
PID 1980 wrote to memory of 2696	1980	jhdfkldfhndfkjdfnbfklfnf.exe	92
PID 4296 wrote to memory of 3848	4296	RegAsm.exe	96
PID 4296 wrote to memory of 3848	4296	RegAsm.exe	96
PID 4296 wrote to memory of 3848	4296	RegAsm.exe	96
PID 4296 wrote to memory of 3848	4296	RegAsm.exe	96
PID 4296 wrote to memory of 588	4296	RegAsm.exe	97
PID 4296 wrote to memory of 588	4296	RegAsm.exe	97
PID 4296 wrote to memory of 588	4296	RegAsm.exe	97
PID 4296 wrote to memory of 588	4296	RegAsm.exe	97
PID 4296 wrote to memory of 3836	4296	RegAsm.exe	98
PID 4296 wrote to memory of 3836	4296	RegAsm.exe	98
PID 4296 wrote to memory of 3836	4296	RegAsm.exe	98
PID 1980 wrote to memory of 1200	1980	jhdfkldfhndfkjdfnbfklfnf.exe	99
PID 1980 wrote to memory of 1432	1980	jhdfkldfhndfkjdfnbfklfnf.exe	101
PID 1980 wrote to memory of 4548	1980	jhdfkldfhndfkjdfnbfklfnf.exe	103
PID 1980 wrote to memory of 1700	1980	jhdfkldfhndfkjdfnbfklfnf.exe	105
PID 1980 wrote to memory of 2828	1980	jhdfkldfhndfkjdfnbfklfnf.exe	107
PID 1980 wrote to memory of 4716	1980	jhdfkldfhndfkjdfnbfklfnf.exe	110
PID 1980 wrote to memory of 3968	1980	jhdfkldfhndfkjdfnbfklfnf.exe	112
PID 1980 wrote to memory of 4888	1980	jhdfkldfhndfkjdfnbfklfnf.exe	114
PID 1980 wrote to memory of 3236	1980	jhdfkldfhndfkjdfnbfklfnf.exe	116
PID 1980 wrote to memory of 5692	1980	jhdfkldfhndfkjdfnbfklfnf.exe	118
PID 1980 wrote to memory of 5184	1980	jhdfkldfhndfkjdfnbfklfnf.exe	120
PID 1980 wrote to memory of 5552	1980	jhdfkldfhndfkjdfnbfklfnf.exe	122
PID 1980 wrote to memory of 1496	1980	jhdfkldfhndfkjdfnbfklfnf.exe	124
PID 1980 wrote to memory of 2336	1980	jhdfkldfhndfkjdfnbfklfnf.exe	126

C:\Users\Admin\AppData\Local\Temp\2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe"
1⤵
- Adds Run key to start application
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:5400
- C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
  C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
  2⤵
  - Executes dropped EXE
  - Adds Run key to start application
  - Suspicious use of SetThreadContext
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
    0
    3⤵
    - Suspicious use of SetThreadContext
    - Reads the TCP/IP host and domain name from the registry
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4296
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp1454.tmp"
      4⤵
      PID:3848
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp14C3.tmp"
      4⤵
      PID:588
  - - C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe
      C:\Windows\Microsoft.NET\Framework\v2.0.50727\cvtres.exe -f "C:\Users\Admin\AppData\Local\Temp\tmp14D3.tmp"
      4⤵
      PID:3836
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2696
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1200
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1432
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4548
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1700
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2828
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4716
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3968
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:4888
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:3236
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5692
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5184
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:5552
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:1496
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - System Location Discovery: System Language Discovery
    - Scheduled Task/Job: Scheduled Task
    PID:2336
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:5220
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1560
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3552
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2248
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:1548
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2704
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:2276
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:3240
- - C:\Windows\SysWOW64\schtasks.exe
    C:\Windows\SysWOW64\schtasks.exe /create /sc minute /mo 1 /tn "winmgr119.exe" /tr "C:\ProgramData\winmgr119.exe" /f
    3⤵
    - Scheduled Task/Job: Scheduled Task
    PID:4588

C:\ProgramData\winmgr119.exe
C:\ProgramData\winmgr119.exe
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:4248

C:\ProgramData\winmgr119.exe
"C:\ProgramData\winmgr119.exe"
1⤵
- Executes dropped EXE
- Subvert Trust Controls: Mark-of-the-Web Bypass
- System Location Discovery: System Language Discovery
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
PID:3180

C:\ProgramData\winmgr119.exe
"C:\ProgramData\winmgr119.exe"
1⤵
PID:3904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

jhdfkldfhndfkjdfnbfklfnf.exe

Path C:\ProgramData\jhdfkldfhndfkjdfnbfklfnf.exe
Size 2.6MB
SHA256 22f411cfad8453326dfaf281f5fe2aeb300626b799380bbc8fa53f612be9a0f1
MD5 89352878f44bf81b7dac359bea67a613
SHA1 efa7980f1ca93a8c93a2b9f6501e70ee514c521d
SHA512 1d061dc041fb3a84635dce4cb744ec8307f2abcfcf2055795b55537aff25076b95984373b320e14d5f92472c7ed80a8f058e7e3775a3cb6e48188447694ec38d
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4e1:ObCjPKNqQEfsw43qtmVfq48
TLSH
T14CC5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2c945db753d341ef9b0f02d75d493749

Path C:\ProgramData\khaxFMfI\2c945db753d341ef9b0f02d75d493749
Size 8B
SHA256 7bbbb2044a7f1ab7d5481eecf3cbb17b5568b7a7f1fe52cc034b64feb78fa026
MD5 38e6f1919ef14870a9cb84b94f8c90cf
SHA1 196731e7fbc84292ecd88e928a311ce736f43277
SHA512 cb4035a54f6beed55fbe3b88a69606c7527c571f07ef8a3c0f0bed10a9db284de755ef74f7d0d8fa68324a3f466f7a16f5d68f6e51e48b0297d95c6398c0b32a
MD5 SHA1 SHA512

Submit Download

winmgr119.exe

Path C:\ProgramData\winmgr119.exe
Size 2.6MB
SHA256 cb6091f59aac65e45936effd2cc3ab0817f85ca0b21ec0842f59362f55c69d62
MD5 4b3c0928a3f2f7b1189e104c2246e2bd
SHA1 d99034f830f919f703ff94e60ac7e5f14797b540
SHA512 b9b7bea9b428b4969ea156810f4e855b3500d786abd4bbe76e528ada5a9b5cbaf84ca1702cd5b7a2f43b1d924ccb9f4a0661350700d19e7901c736518530b63c
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4ev:ObCjPKNqQEfsw43qtmVfq40
TLSH
T154C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

winmgr119.exe:Zone.Identifier

Path C:\ProgramData\winmgr119.exe:Zone.Identifier
Size 24B
SHA256 ccc0133d8f43d3021eb667f86ae939f7f8ec83e727b8334f9e0facccd6d01063
MD5 6c72a5fcdb3c81dcc440e3616f704c5d
SHA1 6198b674ca75562852ea27ebb0f36249c6d0fbb6
SHA512 5b549f5a550e9b8857643c0d223c591e8b59f43a4899a5d7a8f045d5df00e165d8cd1faead61b8f57c3f846c360e8852c9be8b28a9b5d51ffe9a40b4837d5aef
MD5 SHA1 SHA512

Submit Download

2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-10-01_849b89768888a8fcc3970b10721c1cbe_elex_stop.exe
Size 2.6MB
SHA256 d93f8153e7767f5f4b773e31b743ad01157517c2247929065fee98a291988be6
MD5 849b89768888a8fcc3970b10721c1cbe
SHA1 e100e5565f0f314dae2b065831608da749ae6379
SHA512 763e4904f42049bd1eed0b47c9372820d25cec1a3149f9ddc8bbef9500a098658b20df131c4185e228b12fd308eb90696a58b57b059f0633184eb6aa27e5316e
SSDEEP 24576:ObCj2sObHtqQ4QEfCr7w7yvuqqNq8FroaSaPXRackmrM4Biq7MhLv9GImmVfq4er:ObCjPKNqQEfsw43qtmVfq4o
TLSH
T148C5D0C5F2AA40E2DC123FF5582567C78B344E364B3840597BAB3D498F335E6C11AAB6
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/588-25-0x0000000000400000-0x0000000000491000-memory.dmp

Download

memory/3836-27-0x0000000000400000-0x000000000043C000-memory.dmp

Download

memory/3848-19-0x0000000000400000-0x000000000048E000-memory.dmp

Download

memory/4296-9-0x0000000000500000-0x00000000005CA000-memory.dmp

Download

memory/4296-10-0x0000000002410000-0x0000000002420000-memory.dmp

Download

memory/4296-11-0x0000000073562000-0x0000000073564000-memory.dmp

Download

memory/4296-31-0x0000000073562000-0x0000000073564000-memory.dmp

Download