Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
17/10/2026, 00:05
Behavioral task
behavioral1
Sample
2026-10-15_0668c818295fe97aab275c9ba6fe1a67_elex_hive.exe
Resource
win10v2004-20260911-en
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-10-15_0668c818295fe97aab275c9ba6fe1a67_elex_hive.exe
Resource
win11ltsc2024-20260911-en
3 signatures
150 seconds
General
- Target 2026-10-15_0668c818295fe97aab275c9ba6fe1a67_elex_hive.exe
- Size 3.5MB
- Sample261017-add3msft2t
- SHA256 9eca439bfa0bd129a37376c269c044b0939e78eef4df8449a23e6e518497e303
- MD5 0668c818295fe97aab275c9ba6fe1a67
- SHA1 69be5ecf752d8323522b466e7ea8f91d690c81e4
- SHA512 393c77f743ca89d4380bae12cc81dad1b92e43f78e038f6a5a2bd1002427c19ac966d138da6d6761aefc0c158b65477e27830acb4886541f6ca633ee94d7adf9
- SSDEEP 98304:HykyynV/fO7uMD3DjUQ617llHa958MJuKv2:S1ee7uMDUX17llHaP8MI
- TLSH T10F06335C921A583DF07C6CB6584A50B0262B7AEC4FCA14FB9401BDDFC441DA1EA5BBE3
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
9/10
Malware Config
Signatures
- UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral2/memory/2008-0-0x0000000000930000-0x00000000031AA000-memory.dmp UPX behavioral2/memory/2008-2-0x0000000000930000-0x00000000031AA000-memory.dmp UPX -
resource yara_rule behavioral2/memory/2008-0-0x0000000000930000-0x00000000031AA000-memory.dmp upx behavioral2/memory/2008-2-0x0000000000930000-0x00000000031AA000-memory.dmp upx - Program crash 1 IoCs
pid pid_target Process procid_target 4308 2008 WerFault.exe 89
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-15_0668c818295fe97aab275c9ba6fe1a67_elex_hive.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-15_0668c818295fe97aab275c9ba6fe1a67_elex_hive.exe"1⤵PID:2008
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2008 -s 2482⤵
- Program crash
PID:4308
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 2008 -ip 20081⤵PID:1480