1d14dfc6c4be94535598c9334e661b5a510a187553908b300c160c140e93d9d1

Analysis

max time kernel
150s
max time network
152s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
17/04/2026, 04:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-17_93a6542cb3d191a443cf3e177b3bd8b3_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
Size 200KB
Sample260417-esae8ae13l
SHA256 1d14dfc6c4be94535598c9334e661b5a510a187553908b300c160c140e93d9d1
MD5 93a6542cb3d191a443cf3e177b3bd8b3
SHA1 f6c041bbc9b87538eca785f534190d8c04fd007c
SHA512 a1eb87e3c6618802dbbe0acaf3cdc1979209291800ef3313fb20bc6d8048f4846a4412350c1b71d0c8979e36b65e0cd15c064f8ebf2c5202807cee27d953bb9b
SSDEEP 3072:mW0005KJpBpPrEU2JOMRnlNi3MGQ6JsIo1+XDiJcp8:mW0MBpIn0MPI32WsR18GKp8
TLSH
T160147C353281C033D96715748EE8C77A5ABEB83207A554CBB7E40B799F643E28B3534A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000\Control Panel\International\Geo\Nation	2026-04-17_93a6542cb3d191a443cf3e177b3bd8b3_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-17_93a6542cb3d191a443cf3e177b3bd8b3_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-914486190-3969805341-592249730-1000_Classes\Local Settings	2026-04-17_93a6542cb3d191a443cf3e177b3bd8b3_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
5764	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4588 wrote to memory of 5764	4588	2026-04-17_93a6542cb3d191a443cf3e177b3bd8b3_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-17_93a6542cb3d191a443cf3e177b3bd8b3_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-17_93a6542cb3d191a443cf3e177b3bd8b3_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:4588
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\HWID.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:5764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HWID.txt

Path C:\HWID.txt
Size 271B
SHA256 7e72094ec3262175ec26e5f5665aa39d0b9eeac6221329fc4f85b3db382f1f90
MD5 beae9f5c7782207d69df9197e0f04480
SHA1 c3872cb9d01ba8a228293189d5dbdacad6a679cf
SHA512 633c12792c272dab82f6d39dab21f637de7006777afb21c4e44d0796fb6b86d647b00e07420615ac3d29d2e9dacae39120f76b303dcd0167209e8eff01341f7f
TLSH
T1CBD02B083666BD41071A06C3939206F4F10C4634CD438808D80127493421D25A66B6CA
MD5 SHA1 SHA512 TLSH

Submit Download