Analysis
- max time kernel
149s - max time network
141s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
31/07/2026, 23:45
General
- Target 2026-07-31_6e71b181d82c0bbc8953a201a4858034_elex_stealc_stop_tofsee.exe
- Size 930KB
- Sample260731-3r4vfaar41
- SHA256 afacf945aefadf6dda09485466bb61c0f043f75c5087788019535b7621c0ef8a
Malware Config
Signatures
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_6e71b181d82c0bbc8953a201a4858034_elex_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_6e71b181d82c0bbc8953a201a4858034_elex_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS47675E69\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS47675E69\BlueStacksInstaller.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS47675E69\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS47675E69\HD-CheckCpu.exe" --cmd checkHypervEnabled3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zS47675E69\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS47675E69\HD-CheckCpu.exe" --cmd checkSSE43⤵
- Executes dropped EXE
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
backicon.png
change_click.png
close_red.png
custom.png
discord_icon.png
folder.png
help_icon.png
info_icon.png
installer_bg.jpg
installer_logo.png
installer_minimize.png
loader.png
logo_text.png
setpath.png
BlueStacksInstaller.exe
BlueStacksInstaller.exe.config
HD-CheckCpu.exe
JSON.dll
i18n.en-US.txt
ThemeFile
installer_bg_1.jpg
memory/4928-148-0x000000001B190000-0x000000001B1F8000-memory.dmp
memory/4928-152-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-164-0x0000000020CA0000-0x00000000211C8000-memory.dmp
memory/4928-165-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-163-0x000000001F090000-0x000000001F09E000-memory.dmp
memory/4928-153-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-145-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-151-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-150-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-147-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-161-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-159-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-141-0x00007FFC6847F000-0x00007FFC68480000-memory.dmp
memory/4928-143-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-142-0x0000000000510000-0x00000000005B4000-memory.dmp
memory/4928-179-0x000000001BE70000-0x000000001BE78000-memory.dmp
memory/4928-144-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-162-0x000000001F0C0000-0x000000001F0FE000-memory.dmp
memory/4928-190-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-191-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-192-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-193-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-194-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp
memory/4928-195-0x00007FFC682F0000-0x00007FFC68C94000-memory.dmp