Analysis
- max time kernel
152s - max time network
129s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
29/10/2026, 22:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
ELKA.PowerThrottleControl.exe
Resource
win10v2004-20260911-en
2 signatures
150 seconds
Behavioral task
behavioral2
Sample
ELKA.PowerThrottleControl.exe
Resource
win11ltsc2024-20260911-en
2 signatures
150 seconds
General
- Target ELKA.PowerThrottleControl.exe
- Size 169.7MB
- Sample261029-2sasbaty3p
- SHA256 f5891e2278d12b1d0c6cf5a5f28d25f7a3d2c58783af8827914ec390ad60aead
- MD5 36f631517de182b66a79b7e89d94ff78
- SHA1 0ae0ca83fca3f206b3ed290f06b08394b14ad6d8
- SHA512 b64359a42f5bda0d3dcff3b03ed74751c0227a2a8228694f78139553bf30fe13b623f6a76df421604bf370b5d2faf4a7409e58ddc25a57d474fa6c61201be3ae
- SSDEEP 786432:S47N95qOypPXV5OtsFdIMNaHiyJ5/zQG+x5oWeuPRpvwOJQSHKEelCkkNA9n6DZc:bB9cOqYkaHikujx5WujJpH3Zjy
- TLSH T165888D1173E82B55E1BA8378D7B28692D6F1BC925351E1CF144CFA492E73BC16A36332
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
- Loads dropped DLL 3 IoCs
pid Process 3744 ELKA.PowerThrottleControl.exe 3744 ELKA.PowerThrottleControl.exe 3744 ELKA.PowerThrottleControl.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3744 ELKA.PowerThrottleControl.exe
Processes
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\.net\ELKA.PowerThrottleControl\RjI9t-X6ON5H\D3DCompiler_47_cor3.dll
- Size 4.5MB
- SHA256 a05f99734f7c4822fefc12b367af21fd0976ed6608752fb1e1e80b6ece7ecbbb
- MD5 19e527a35241c171d37dc1e6c530053c
- SHA1 b1567bada7a27ab78e65da440f21809f50b9d34c
- SHA512 23d38b55f5b17bf0228b16a85787d384da0a700190fc289281190272a0d2dd374be0f7f64d8b642836ccbe2351b72e9ef5c7e2b12d0a7495317e986fd5e3c886
- SSDEEP 49152:c6ntbdeqBH287v7cavvL4e0OgcmeNHyxsBSoYHXahOO5uBcLr7mbpJ3E/V:cUdeqt737jFm5wd
- TLSH T143268D56A7E840E9D1BBD138DA87821BEBF1B80413349BDF015086599F73BD26A3E734
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\ELKA.PowerThrottleControl\RjI9t-X6ON5H\PresentationNative_cor3.dll
- Size 1.2MB
- SHA256 3fb36edaa2c4fe4ac8be075a3a4e903da159bbe38fb77e51c32b58e2adecb2d6
- MD5 b43c09fd1eab8feb0d9d87e6eeb8fa95
- SHA1 d8935765faf6e12d1d7f7e8b0f54f8e0f077a43c
- SHA512 1432fefe98029f475c0a53e0c551dd917713da346e9b7d5ee5ee5314fb43072cfb24f95b4e2ceef2f67d7f01084d398428b075bf09812a9f90f510f0a40bdfc8
- SSDEEP 24576:mhNpKcF6kPHmTw+MLYpX7T3hjnHFOcJqCPoG5MupGJvaCbztQcfRYQXLFGvHLPa7:mxKcdPHmMLYpX7T35/fPoGPpGFjztQcT
- TLSH T1F0453A22E2E642E5C47FC1B8C646972BFBB07449131C66CB87608B552F67FE0963E364
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Users\Admin\AppData\Local\Temp\.net\ELKA.PowerThrottleControl\RjI9t-X6ON5H\wpfgfx_cor3.dll
- Size 1.9MB
- SHA256 4b4fdbd1a77ac91a348d3d83a06bc103c6617fdd11445e327b7b6019bcfc1a6d
- MD5 8d8bc2c0a836661c601330f9c184cec5
- SHA1 58e6e5f72e5d51e0cde18f6c7bf296a5bb4d004d
- SHA512 f27e64c6acce5727ce1cfcf3d3fe4ff600fe41643b7886ab1d117724e48d39253702bae381734588eb0d5756cddc73912f109a8d683d090c278075875ad6fa9e
- SSDEEP 49152:CJBarecoR28GPaM6YqVim/oBiEyBhoci/H:0nlkRwiIoBi1BK/
- TLSH T13B955A46B6AC40E9C07AD33CDAD7961BF27174152761A3CF23A0479E6F27BD00A7A361
- MD5 SHA1 SHA512 SSDEEP TLSH