Analysis
- max time kernel
149s - max time network
149s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
09/05/2026, 04:03
General
- Target 2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
- Size 500KB
- Sample260509-emmtcsav7x
- SHA256 6caf0368366df4deeeaa28dfec1f5c20725d89001f1048c02870bc9fee5ef2bf
Malware Config
Signatures
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Executes dropped EXE 1 IoCs
- Drops desktop.ini file(s) 2 IoCs
- Drops file in Windows directory 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Enumerates system info in registry 2 TTPs 2 IoCs
- Modifies system certificate store 2 TTPs 5 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- System Location Discovery: System Language Discovery
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\n2704\s2704.exe"C:\Users\Admin\AppData\Local\Temp\n2704\s2704.exe" ins.exe /h 4b043.api.socdn.com /e 5367498 /u 50d1d9d5-cf90-407c-820a-35e05bc06f2f /v "C:\Users\Admin\AppData\Local\Temp\2026-05-09_f44fd051468509022b2f76698547bf42_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe"2⤵
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1048 -s 44362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 436 -p 1048 -ip 10481⤵
Network
MITRE ATT&CK Enterprise v16
Defense Evasion
Modify Registry
1Subvert Trust Controls
1Install Root Certificate
1Virtualization/Sandbox Evasion
1Replay Monitor
Loading Replay Monitor...
Downloads
s2704.exe
memory/1048-56-0x0000000003290000-0x000000000351B000-memory.dmp
memory/2476-44-0x000000001FC10000-0x000000001FC72000-memory.dmp
memory/2476-46-0x0000000020780000-0x0000000020C90000-memory.dmp
memory/2476-34-0x0000000001120000-0x000000000112A000-memory.dmp
memory/2476-37-0x000000001C5E0000-0x000000001CAAE000-memory.dmp
memory/2476-38-0x000000001CB50000-0x000000001CBEC000-memory.dmp
memory/2476-39-0x0000000001130000-0x0000000001138000-memory.dmp
memory/2476-40-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-41-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-42-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-45-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-13-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-12-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-43-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-47-0x00007FFF42A85000-0x00007FFF42A86000-memory.dmp
memory/2476-48-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-49-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-50-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-51-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-53-0x0000000000E10000-0x0000000000E1C000-memory.dmp
memory/2476-54-0x000000001CC90000-0x000000001CD3F000-memory.dmp
memory/2476-55-0x00007FFF427D0000-0x00007FFF43171000-memory.dmp
memory/2476-11-0x00007FFF42A85000-0x00007FFF42A86000-memory.dmp