2809e6a490547290c6c75ff71c3973cf3e9b51039abd7d55ec49976d1d528aac

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
09/05/2026, 01:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
Size 1.4MB
Sample260509-be4kcsgz2x
SHA256 2809e6a490547290c6c75ff71c3973cf3e9b51039abd7d55ec49976d1d528aac
MD5 9daa863d463890a455185bd5f5d86429
SHA1 23398f9bf1ac883add12625040525236932c2249
SHA512 1900bca3e0a964e4012e7525224cb06e48671037736a4435475200b2fbdbfced813eda6eff96df5f6087a3b8c18ed0dc5d34c6678d37e69e407d4a9985e9a6be
SSDEEP 24576:MjHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:MTGkQy56/OJdJCXDrsOFZMjHfUr
TLSH
T103658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

9^/10

discovery upx

Malware Config

Signatures

Custom signature

Detection of CryptoLocker Variants 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000022a24-3.dat	CryptoLocker_rule2

Custom signature

Detection of Cryptolocker Samples 1 IoCs

resource	yara_rule
behavioral1/files/0x0005000000022a24-3.dat	CryptoLocker_set1

Custom signature

UPX dump on OEP (original entry point) 9 IoCs

resource	yara_rule
behavioral1/memory/3968-0-0x00000000009C0000-0x0000000000A49000-memory.dmp	UPX
behavioral1/files/0x0005000000022a24-3.dat	UPX
behavioral1/memory/452-4-0x0000000000B40000-0x0000000000BC9000-memory.dmp	UPX
behavioral1/memory/3968-20-0x00000000009C0000-0x0000000000A49000-memory.dmp	UPX
behavioral1/memory/452-23-0x0000000000B40000-0x0000000000BC9000-memory.dmp	UPX
behavioral1/memory/3968-41-0x00000000009C0000-0x0000000000A49000-memory.dmp	UPX
behavioral1/memory/452-43-0x0000000000B40000-0x0000000000BC9000-memory.dmp	UPX
behavioral1/memory/3968-51-0x00000000009C0000-0x0000000000A49000-memory.dmp	UPX
behavioral1/memory/452-61-0x0000000000B40000-0x0000000000BC9000-memory.dmp	UPX

Executes dropped EXE 1 IoCs

pid	Process
452	cbd17848

Unexpected DNS network traffic destination 4 IoCs

Network traffic to other servers than the configured DNS servers was detected on the DNS port.

description	flow	ioc	pid	Process
Destination IP	3	114.114.114.114	3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
Destination IP	6	223.5.5.5	3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
Destination IP	37	114.114.114.114	3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
Destination IP	39	223.5.5.5	3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe

Drops file in System32 directory 13 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	cbd17848
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8	cbd17848
File created	C:\Windows\SysWOW64\cbd17848	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe

UPX packed file 9 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3968-0-0x00000000009C0000-0x0000000000A49000-memory.dmp	upx
behavioral1/files/0x0005000000022a24-3.dat	upx
behavioral1/memory/452-4-0x0000000000B40000-0x0000000000BC9000-memory.dmp	upx
behavioral1/memory/3968-20-0x00000000009C0000-0x0000000000A49000-memory.dmp	upx
behavioral1/memory/452-23-0x0000000000B40000-0x0000000000BC9000-memory.dmp	upx
behavioral1/memory/3968-41-0x00000000009C0000-0x0000000000A49000-memory.dmp	upx
behavioral1/memory/452-43-0x0000000000B40000-0x0000000000BC9000-memory.dmp	upx
behavioral1/memory/3968-51-0x00000000009C0000-0x0000000000A49000-memory.dmp	upx
behavioral1/memory/452-61-0x0000000000B40000-0x0000000000BC9000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\7bd08	cbd17848
File opened for modification	C:\Windows\43ef00	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cbd17848

Modifies data under HKEY_USERS 9 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	cbd17848
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	cbd17848
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	cbd17848
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	cbd17848
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	cbd17848
Set value (str)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	cbd17848
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	cbd17848
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	cbd17848
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	cbd17848

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
452	cbd17848
3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
Token: SeTcbPrivilege	3968	2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
Token: SeDebugPrivilege	452	cbd17848
Token: SeTcbPrivilege	452	cbd17848

C:\Users\Admin\AppData\Local\Temp\2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-09_9daa863d463890a455185bd5f5d86429_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe"
1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3968

C:\Windows\Syswow64\cbd17848
C:\Windows\Syswow64\cbd17848
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

cbd17848

Path C:\Windows\SysWOW64\cbd17848
Size 1.4MB
SHA256 b86938e4ad66444f4a527ba542ed1f1e5ae34198478c1475b111dce984f370a4
MD5 c20e5208270f38a79fb6b51fa571fa2d
SHA1 b22c422a3799e28ebdacd5314e3b3c6452dea874
SHA512 24e9e2a5b284deba3366336896370a3e454e30228c07fca820a1b87001c0c09f4ef051ddb21842fa0c0afba606e3ce2c9dd23b2f64665db3dac9d80d9805c72a
SSDEEP 24576:NjHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:NTGkQy56/OJdJCXDrsOFZMjHfUr
TLSH
T120658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/452-4-0x0000000000B40000-0x0000000000BC9000-memory.dmp

Download

memory/452-23-0x0000000000B40000-0x0000000000BC9000-memory.dmp

Download

memory/452-24-0x0000000001620000-0x00000000016FC000-memory.dmp

Download

memory/452-43-0x0000000000B40000-0x0000000000BC9000-memory.dmp

Download

memory/452-61-0x0000000000B40000-0x0000000000BC9000-memory.dmp

Download

memory/3968-0-0x00000000009C0000-0x0000000000A49000-memory.dmp

Download

memory/3968-20-0x00000000009C0000-0x0000000000A49000-memory.dmp

Download

memory/3968-22-0x0000000000FF0000-0x00000000010CC000-memory.dmp

Download

memory/3968-41-0x00000000009C0000-0x0000000000A49000-memory.dmp

Download

memory/3968-51-0x00000000009C0000-0x0000000000A49000-memory.dmp

Download