Analysis
- max time kernel
148s - max time network
144s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
11/10/2026, 06:17
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe
- Size 1.2MB
- Sample261011-g2jrcswzhy
- SHA256 b29878550b3cc17f703d4925c954d50f5870eb0bea6ae4045777fcffaa1686c3
- MD5 a776d5b6feddfb71516d0acd9e93edb9
- SHA1 5ffa7b4f5bf0d79c36148b69fed4922288e92a10
- SHA512 a1c452a444c197e9fcc69b3b01e2b1f3688b0aad1f352cd822c4b4e120e0ec97f97662134700bd9d6b94c86ec1c4480bcb99189b842a37557a16596dfdea3b65
- SSDEEP 24576:nvpH41Cl36RgrO/+xto6R1MTXSDU9VH+zPlq7:XmGtoZTXSDb47
- TLSH T16455DF417BF6C2B7DBC241B508A6871A46379CC127AF9EC7F7C03C599D302D96A3A285
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
5/10
Malware Config
Signatures
- Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\System32\alg.exe 2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe File opened for modification C:\Windows\system32\AppVClient.exe 2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 5968 2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-10_a776d5b6feddfb71516d0acd9e93edb9_elex_stop.exe"1⤵
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:5968