022275639664dba02d76ec79e4c5b2434d1a2ce90d116fbf6b8bd52ad22e4598

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/10/2026, 21:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe
Size 99.6MB
Sample261012-1pwpyaeg89
SHA256 022275639664dba02d76ec79e4c5b2434d1a2ce90d116fbf6b8bd52ad22e4598
MD5 50e4297cec3a2b7712e857a48ec418c4
SHA1 f08b18d46178dbafb652324a8a84807bce46b0e1
SHA512 a1747405d362a9ddf367929f04862b4dc78733a6cf4e726c69c4e96ac1c31ac03f52319e3a61428a3ad9417c98a9371c0d5831097bb1d71814c2d81f16aee3a7
SSDEEP 786432:DLybhXFfmndCQXxQKrc3rzKHuoChw6uqQG:D4udtXxQKryrzKH7ChnMG
TLSH
T1FC383313F3DD64F1C8927B7238B69227EB357B059B0259CB57F47E1788222935BAA301
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4412	lenovodm.exe
2736	calculator1.exe

AutoIT Executable 1 IoCs

AutoIT scripts compiled to PE executables.

resource	yara_rule
behavioral2/memory/5092-0-0x0000000000400000-0x00000000004D3000-memory.dmp	autoit_exe

Drops file in Program Files directory 4 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\AppPatch\calculator1.exe	2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe
File opened for modification	C:\Program Files (x86)\AppPatch\calculator1.exe	2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe
File created	C:\Program Files (x86)\AppPatch\lenovodm.exe	2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe
File opened for modification	C:\Program Files (x86)\AppPatch\lenovodm.exe	2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calculator1.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2736	calculator1.exe
2736	calculator1.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5092 wrote to memory of 4412	5092	2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe	89
PID 5092 wrote to memory of 2736	5092	2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-11_50e4297cec3a2b7712e857a48ec418c4_agent-tesla_backswap_elex_hijackloader_stop.exe"
1⤵
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5092
- C:\Program Files (x86)\AppPatch\lenovodm.exe
  "C:\Program Files (x86)\AppPatch\lenovodm.exe"
  2⤵
  - Executes dropped EXE
  PID:4412
- C:\Program Files (x86)\AppPatch\calculator1.exe
  "C:\Program Files (x86)\AppPatch\calculator1.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

calculator1.exe

Path C:\Program Files (x86)\AppPatch\calculator1.exe
Size 3.3MB
SHA256 e89bcecb8e9585974ff22fd4c0e2eeaea2920f6c542598af867dd08019fead9b
MD5 cab21ca34a172789696a4cd3ce57bc99
SHA1 8ca0f3cd7abbedfc0923a7c6bf1879c2af6b8ec0
SHA512 199d531b8e02340b597b4d09160001f659307b27a8d622f7e2491b2595ccac0276fe111d636bc1c2a9f5c5761ab712d16ab045b546ea8d49996040a2ae4b47ea
SSDEEP 98304:qEzgfi7Z0GebdOLHiDYt+nIuLehpwg7zhr:qEz2Cp7wg7zhr
TLSH
T18CF57D217F526176F63302334E18F6BDE5ADA8A04BF5C1CB0168666D2A315C35A3F27B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

lenovodm.exe

Path C:\Program Files (x86)\AppPatch\lenovodm.exe
Size 2.9MB
SHA256 3449d384fa77f35820d176df486c1b83ac25410179704218126750536f0e7ddd
MD5 fba4f148fba9c9106caa6d4aff4a3d66
SHA1 4064f51e2770b797fc3ce29624aa147bc0206098
SHA512 896db5daaeb2a77b7b48c092aa4bb8013cc3e93c2fa871365557fa5ee2aaebde2f83b53cba91adc329c0c4d67d158dd79faa2bbca7fd12f1eb8dd1ca6817ee51
SSDEEP 24576:rQyvC8XcG7AtNwk39SddFgb5ORc+RESUD+gClXc0FFwCcCkQgnWSLlOZ69kkjBuR:tvj7NKqnOlD+hc0Hk/LlOZCVIa
TLSH
T160E59200EE01B12DE8A301BF89BFC5795914AD5013372CFFDB8A7C6A5A759E22F39056
MD5 SHA1 SHA512 SSDEEP TLSH