Analysis
- max time kernel
150s - max time network
147s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
31/07/2026, 12:06
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee.exe
Resource
win11ltsc2024-20260709-en
windows11-ltsc_2024-x64
7 signatures
150 seconds
General
- Target 2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee.exe
- Size 519KB
- Sample260731-n94vtsfn21
- SHA256 06000dc579932f7d58aa1f94a1352cf8971ec19a24f9aeceabb4bfcfb9763968
- MD5 39dd5ae18a6403d968d38b95e244f00a
- SHA1 ffbfdf7ca208d08979f8ccb3c0f3223451ed9e86
- SHA512 3e12511690aa6b9936794a3e4bb86581af2aedf15d1d8d5d28bc45036b780e8ad008f4ee72307f8112bdc6d7c86d49e89a04326513a220a31d7b6f37ab3c9852
- SSDEEP 3072:Kql7oLfyiRA3DcPnZmM2lO+QQjdSObyCw5sloGFE:R7oQj39bbFqGK
- TLSH T1F6B45B24B681C433E8A30871A8ACC7BE691CBA711B5550C7F7C85FAD1BB52E35B3125B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
8/10
Malware Config
Signatures
- Boot or Logon Autostart Execution: Port Monitors 1 TTPs 13 IoCs
Adversaries may use port monitors to run an adversary supplied DLL during system boot for persistence or privilege escalation.
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\IPP spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\USB Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Adapters\WSPrint\OfflinePorts spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Appmon\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Local Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Standard TCP/IP Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\Virtual Port Monitor\Ports spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port spoolsv.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\Print\Monitors\WSD Port\Ports spoolsv.exe - Drops file in System32 directory 22 IoCs
description ioc Process File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f} DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67E0.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67E1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\MPDW-PDC.xml DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67F2.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67F2.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\MPDW-pipelineconfig.xml DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67DE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\MPDW_devmode_map.xml DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67DF.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\prnms009.cat DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67F3.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67F3.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67DF.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67E0.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\prnms009.Inf DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\MPDW-manifest.ini DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67DE.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67E1.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67F4.tmp DrvInst.exe File created C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\SET67F4.tmp DrvInst.exe File opened for modification C:\Windows\System32\DriverStore\Temp\{5dd56679-c99a-af4c-a863-4c46db5a6e7f}\MPDW-constraints.js DrvInst.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\INF\setupapi.dev.log spoolsv.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe - System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee.exe - Checks SCSI registry key(s) 3 TTPs 16 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Service spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Service spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\Properties\{3b2ce006-5e61-4fde-bab8-9b8aac9b26df}\0002 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_DADY&Prod_HL-DT-ST_DVD+-RW\4&215468a5&0&010000\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\Service spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001\HardwareID spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\HardwareID spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000001 spoolsv.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\CdRom&Ven_Msft&Prod_Virtual_DVD-ROM\2&1f4adffe&0&000002\Service spoolsv.exe - Modifies data under HKEY_USERS 12 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Key created \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-20\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices spoolsv.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\Devices\Send To OneNote 2016 = "winspool,nul:" spoolsv.exe Set value (str) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows NT\CurrentVersion\PrinterPorts\Send To OneNote 2016 = "winspool,nul:,15,45" spoolsv.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2416 2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee.exe 2416 2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-31_39dd5ae18a6403d968d38b95e244f00a_elex_stealc_stop_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
PID:2416
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
- Boot or Logon Autostart Execution: Port Monitors
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
PID:4908
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "4" "d" "C:\Windows\system32\spool\tools\Microsoft Print To PDF\prnms009.Inf" "9" "43057df13" "0000000000000190" "WinSta0\Default" "0000000000000194" "208" "C:\Windows\system32\spool\tools\Microsoft Print To PDF"1⤵
- Drops file in System32 directory
- Drops file in Windows directory
PID:2304