Analysis
- max time kernel
150s - max time network
128s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260911-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
10/11/2026, 19:51
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
4 signatures
150 seconds
General
- Target 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe
- Size 1.1MB
- Sample261110-yk2paaae98
- SHA256 887affa55a45d14fa7bb7a3f5c8d77c77b6419698d486135399859f48981a306
- MD5 50cb8b0e228f8b165ee45f19ba2bf536
- SHA1 c957ba183a826ef43ea1d4c0c200660af434592a
- SHA512 6a2c119f66e20f1569b06302e14712c6c4c94710a4c375568381b31f57fd167dfac37bae41932601628795c7fd39d807649729c8c2d4246e3ff6474041754a73
- SSDEEP 24576:aDrRoNk7BZpxyBrrB19S/i5zX4GaXVav9MkH:aDrRokpxyR1oidoG7v9MM
- TLSH T17A45BE0177D08879F073997A4D7962286A79BD225F30D2CF3368271DDE72AC1DA39326
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
6/10
Malware Config
Signatures
- Drops desktop.ini file(s) 4 IoCs
description ioc Process File created \??\c:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\$Recycle.Bin\S-1-5-21-461973139-3212354679-1508698038-1000\desktop.ini 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\desktop.ini 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\desktop.ini 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe - Drops file in Program Files directory 64 IoCs
description ioc Process File created \??\c:\Program Files\Common Files\microsoft shared\ink\hi-IN\tipresx.dll.mui 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\rtscom.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.ObjectModel.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\ja\System.Xaml.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\TabTip.exe 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\LICENSE.txt 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\es\UIAutomationClient.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\es\System.Xaml.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\InstallMount.fon 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.ru-ru.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\oskpred.xml 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\kk-KZ\tipresx.dll.mui 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.IO.UnmanagedMemoryStream.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\mscordaccore.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\pt-BR\System.Windows.Forms.Primitives.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\System.Windows.Forms.Primitives.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\ru\System.Xaml.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Net.WebSockets.Client.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.WebProxy.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Runtime.Handles.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\PresentationFramework-SystemData.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\8.0.15\pt-BR\UIAutomationClientSideProviders.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\C2RINTL.et-ee.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\ka-GE\tipresx.dll.mui 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\tipskins.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\oledbjvs.inc 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\GroupDisconnect.mpp 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\StreamServer.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\System\ado\it-IT\msader15.dll.mui 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\Microsoft.NETCore.App.deps.json 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Reflection.Emit.ILGeneration.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\UIAutomationProvider.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\PrivacySandboxAttestationsPreloaded\privacy-sandbox-attestations.dat 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\pt-BR\tipresx.dll.mui 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\System.Security.Cryptography.Primitives.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\fr\System.Windows.Controls.Ribbon.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\System.DirectoryServices.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\lv.pak 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ink\en-US\TipTsf.dll.mui 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.Cryptography.Csp.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\es\System.Xaml.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\UIAutomationTypes.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\System\Ole DB\de-DE\sqlxmlx.rll.mui 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Collections.Immutable.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.15\Microsoft.DiaSymReader.Native.amd64.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\fr\PresentationFramework.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\it\System.Windows.Input.Manipulations.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\it\PresentationFramework.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\tr\ReachFramework.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\api-ms-win-crt-locale-l1-1-0.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\ClickToRun\msvcp120.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\mscorlib.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Diagnostics.TraceSource.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\System.Security.Cryptography.Primitives.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Net.Sockets.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\7-Zip\Lang\de.txt 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\System.Security.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\tr\UIAutomationProvider.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\ja\System.Windows.Controls.Ribbon.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\7.0.16\zh-Hant\UIAutomationClient.resources.dll 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\vi_FEMININE.pak 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\7-Zip\7zCon.sfx 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File created \??\c:\Program Files\Common Files\microsoft shared\ink\or-IN\tipresx.dll.mui 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe File opened for modification \??\c:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe - Program crash 1 IoCs
pid pid_target Process procid_target 5800 3616 WerFault.exe 90 - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe"C:\Users\Admin\AppData\Local\Temp\2026-11-09_50cb8b0e228f8b165ee45f19ba2bf536_amadey_elex_stop.exe"1⤵
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:3616 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3616 -s 7122⤵
- Program crash
PID:5800
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 3616 -ip 36161⤵PID:3212
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k GPSvcGroup1⤵PID:1036
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files\7-Zip\7-zip32.dll
- Size 1.2MB
- SHA256 fe257de4d605f1c5cd17364c4fc269666e110bce38bb437d48137bc0c29bae0a
- MD5 84cbf6359dcb421cce99e8661dadf67f
- SHA1 9bd277d8583fd43ab8478a1d42d0f07fde2fcfdc
- SHA512 54edfcc1d403a210ee71aa9f4c3e5c73859e89522205b69d4554527644c8d1d89ecf282667d2b0a5db01d52268308ec3b03cc71618a855368388b7c73470e446
- SSDEEP 24576:aDrRoNk7BZpxyBrrB19S/i5zX4GaXVav9Mk/:aDrRokpxyR1oidoG7v9M
- TLSH T17945BE0177E08879F0B3597A4D7962286A79BD225F30D2CF3358271DDE72AC1DA39326
- MD5 SHA1 SHA512 SSDEEP TLSH
- Path C:\Program Files\Google\Chrome\Application\140.0.7339.81\Locales\am_FEMININE.pak
- Size 23B
- SHA256 b189beaa211d90f2d81ce45beb5790fe72e9fff13dca5f46ad1461489fe59106
- MD5 b3f6ee17e4d70043651e0205fd942631
- SHA1 09659cf4c7613e3196125ecc6b491ea345993980
- SHA512 bda3d9506c22cdb0f06bc4ff08b7948530dd23dc4f39e544c604bd892ff9b73665f0bf2e7c7228e3d0fc4d72c8a285e40b71443ef57beac0df993a572626dc76
- MD5 SHA1 SHA512
- Path C:\Program Files\dotnet\shared\Microsoft.WindowsDesktop.App\6.0.27\System.Security.Cryptography.Pkcs.dll
- Size 5B
- SHA256 30d9045a9f172208b13161d1f5204e5787e5e07bfbb4f490d0041b03b7f44f76
- MD5 b5b682b742431a52ea8b17c72ad9c572
- SHA1 326320f469235708c59f678c9a7357dca552d306
- SHA512 4e1bd7cc616b3115baf6be7ebd29fe2d1123bc0f25464865a0cf9207b0344fba70747a5ce6f00e8d9c696881f6db1e12f81736bc748b6f2b60bf84c681a49163
- MD5 SHA1 SHA512