Analysis
- max time kernel
150s - max time network
152s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows - submitted
30/08/2026, 21:48
Behavioral task
behavioral1
Sample
2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
Resource
win10v2004-20260513-en
windows10-2004-x64
14 signatures
150 seconds
General
- Target 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe
- Size 1.4MB
- Sample260830-1n89msde42
- SHA256 171fef415e23658af3be23067e338eb69a5aa28f9c723a090e67fd6dc66c863a
- MD5 0f2de41cc73a3c8c5da5d822f955023f
- SHA1 30cef79cc49fa5855e17b192623b01de1a0718c9
- SHA512 aba4f1965aad1ae832ae4faf4a7272e86edb343ec790ac774fd2a91aaa737b677566ced36b3adff38a21e614a0de909096e14c20d2e6ebcb482d13fcad2cf64a
- SSDEEP 24576:tjHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:tTGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T14A658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH
Malware Config
Signatures
- Detects Stealc stealer Version 3 7 IoCs
resource yara_rule behavioral2/memory/3048-16-0x0000000000F00000-0x0000000000F89000-memory.dmp family_stealc_v3 behavioral2/memory/3048-41-0x0000000000F00000-0x0000000000F89000-memory.dmp family_stealc_v3 behavioral2/memory/3048-52-0x0000000000F00000-0x0000000000F89000-memory.dmp family_stealc_v3 behavioral2/memory/3048-53-0x0000000000F00000-0x0000000000F89000-memory.dmp family_stealc_v3 behavioral2/memory/3048-58-0x0000000000F00000-0x0000000000F89000-memory.dmp family_stealc_v3 behavioral2/memory/3048-62-0x0000000000F00000-0x0000000000F89000-memory.dmp family_stealc_v3 behavioral2/memory/3048-65-0x0000000000F00000-0x0000000000F89000-memory.dmp family_stealc_v3 - Detection of CryptoLocker Variants 1 IoCs
resource yara_rule behavioral2/files/0x0009000000016cfd-2.dat CryptoLocker_rule2 - Detection of Cryptolocker Samples 1 IoCs
resource yara_rule behavioral2/files/0x0009000000016cfd-2.dat CryptoLocker_set1 - UPX dump on OEP (original entry point) 15 IoCs
resource yara_rule behavioral2/memory/3048-0-0x0000000000F00000-0x0000000000F89000-memory.dmp UPX behavioral2/files/0x0009000000016cfd-2.dat UPX behavioral2/memory/5364-3-0x0000000000AB0000-0x0000000000B39000-memory.dmp UPX behavioral2/memory/3048-16-0x0000000000F00000-0x0000000000F89000-memory.dmp UPX behavioral2/memory/5364-18-0x0000000000AB0000-0x0000000000B39000-memory.dmp UPX behavioral2/memory/5364-22-0x0000000000AB0000-0x0000000000B39000-memory.dmp UPX behavioral2/memory/5364-24-0x0000000000AB0000-0x0000000000B39000-memory.dmp UPX behavioral2/memory/3048-41-0x0000000000F00000-0x0000000000F89000-memory.dmp UPX behavioral2/memory/5364-42-0x0000000000AB0000-0x0000000000B39000-memory.dmp UPX behavioral2/memory/5364-46-0x0000000000AB0000-0x0000000000B39000-memory.dmp UPX behavioral2/memory/3048-52-0x0000000000F00000-0x0000000000F89000-memory.dmp UPX behavioral2/memory/3048-53-0x0000000000F00000-0x0000000000F89000-memory.dmp UPX behavioral2/memory/3048-58-0x0000000000F00000-0x0000000000F89000-memory.dmp UPX behavioral2/memory/3048-62-0x0000000000F00000-0x0000000000F89000-memory.dmp UPX behavioral2/memory/3048-65-0x0000000000F00000-0x0000000000F89000-memory.dmp UPX - Executes dropped EXE 1 IoCs
pid Process 5364 49dbce90 - Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description flow ioc pid Process Destination IP 293 114.114.114.114 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 294 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 99 114.114.114.114 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 377 114.114.114.114 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 378 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 42 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 164 114.114.114.114 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 237 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 323 114.114.114.114 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 1 114.114.114.114 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 3 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 41 114.114.114.114 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 96 114.114.114.114 5364 49dbce90 Destination IP 97 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 101 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 236 114.114.114.114 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 166 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Destination IP 324 223.5.5.5 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe - Drops file in System32 directory 13 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\66F835E41EC6A985EB9271E4A70169D7_CF44E3C99F7F4AC558EEB35244F7E046 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\81B9B36F9ABC4DA631A4713EE66FAEC6_D78A39BE9A7C3823659C09F61E8BD3E8 49dbce90 File created C:\Windows\SysWOW64\49dbce90 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\Content.IE5 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\IE 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\INetCookies 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\History\History.IE5 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft 49dbce90 File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache 49dbce90 -
resource yara_rule behavioral2/memory/3048-0-0x0000000000F00000-0x0000000000F89000-memory.dmp upx behavioral2/files/0x0009000000016cfd-2.dat upx behavioral2/memory/5364-3-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/3048-16-0x0000000000F00000-0x0000000000F89000-memory.dmp upx behavioral2/memory/5364-18-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/5364-22-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/5364-24-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/3048-41-0x0000000000F00000-0x0000000000F89000-memory.dmp upx behavioral2/memory/5364-42-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/5364-46-0x0000000000AB0000-0x0000000000B39000-memory.dmp upx behavioral2/memory/3048-52-0x0000000000F00000-0x0000000000F89000-memory.dmp upx behavioral2/memory/3048-53-0x0000000000F00000-0x0000000000F89000-memory.dmp upx behavioral2/memory/3048-58-0x0000000000F00000-0x0000000000F89000-memory.dmp upx behavioral2/memory/3048-62-0x0000000000F00000-0x0000000000F89000-memory.dmp upx behavioral2/memory/3048-65-0x0000000000F00000-0x0000000000F89000-memory.dmp upx - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\342ed0 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe File opened for modification C:\Windows\5bd568 49dbce90 - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49dbce90 - Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 49dbce90 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 49dbce90 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 49dbce90 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0" 49dbce90 Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 49dbce90 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1" 49dbce90 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1" 49dbce90 Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1" 49dbce90 Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing 49dbce90 - Suspicious behavior: EnumeratesProcesses 22 IoCs
pid Process 5364 49dbce90 5364 49dbce90 5364 49dbce90 5364 49dbce90 5364 49dbce90 5364 49dbce90 5364 49dbce90 5364 49dbce90 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Token: SeTcbPrivilege 3048 2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe Token: SeDebugPrivilege 5364 49dbce90 Token: SeTcbPrivilege 5364 49dbce90
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-30_0f2de41cc73a3c8c5da5d822f955023f_coinminer_cryptolocker_elex_mafia_stealc_tofsee.exe"1⤵
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3048
-
C:\Windows\Syswow64\49dbce90C:\Windows\Syswow64\49dbce901⤵
- Executes dropped EXE
- Unexpected DNS network traffic destination
- Drops file in System32 directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:5364
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\SysWOW64\49dbce90
- Size 1.4MB
- SHA256 596d755c725d520b84cbe9724ca24918b4e43838d05e63ce3d53f01c193b0037
- MD5 25efa55a679dae64d981ac8222c565a0
- SHA1 b155e7f0117c84791d11c88c0aab846f5b64db2d
- SHA512 75dc894d9e14b2adedbe148c548704b02d5d63061d55fa1ac2a2e17628b201d9b22fef5c0e6046b7654aa1415dca7b6c0d2774dfa49623b275514ceebf9cf14c
- SSDEEP 24576:9jHPOSOkx2LFscU6UQOJdBqsCPhH9Do2sOfNZMjHfUr:9TGkQy56/OJdJCXDrsOFZMjHfUr
- TLSH T13E658E31AAC14132E2B3867186FA56F6A5257C222711E5CF62C97B291E737D3ED3070E
- MD5 SHA1 SHA512 SSDEEP TLSH