a58b16cf90f1d79cc6ee9cd3b188716445845d03712480294715756e51df4fd4

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 08:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
Size 200KB
Sample260908-kfglnavxbs
SHA256 a58b16cf90f1d79cc6ee9cd3b188716445845d03712480294715756e51df4fd4
MD5 ab46e59a27b662b2315a34ce372c478b
SHA1 ae84f576f2e3622f7a74abc83ff4511c92a34e0b
SHA512 d7e99e576abe0c22daab2758f33427e117bc6888837b2f85dbdf7c32c294db0d975ba5702e198152e02be9a8a4ae8b9d24e2369313c63c44857f109eb3d8c871
SSDEEP 3072:R+TjU5VeOBNX3sU+Jyk5nPlq3MGI6JsAY1+u5dJgzT:R+TYBNMPgkRI3+Ws51Jj+zT
TLSH
T114146C353281C033D9A715748EF8C77A5ABEB832076554CBB7E40B799F643E28A3534A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery ransomware

Malware Config

Signatures

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NOTEPAD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3797332335-34111092-3597280141-1000_Classes\Local Settings	2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe

Opens file in notepad (likely ransom note) 1 IoCs

ransomware

pid	Process
2512	NOTEPAD.EXE

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3552 wrote to memory of 2512	3552	2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-07_ab46e59a27b662b2315a34ce372c478b_elex_mafia_rhadamanthys_stealc_stop_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3552
- C:\Windows\SysWOW64\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\HWID.txt
  2⤵
  - System Location Discovery: System Language Discovery
  - Opens file in notepad (likely ransom note)
  PID:2512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HWID.txt

Path C:\HWID.txt
Size 271B
SHA256 a28d8f7836b3e1818768298981e6e63e03ad240d0d2d36ad03619df7f0187590
MD5 510d00c633546b1b8eae13f8784b24a4
SHA1 750b35ac60b7430d0f7bfa34445cfc741a992957
SHA512 d923b1edbcdafa6e57ff39a8a65daaae05c0f82cf814cf62c7c5f48b6f836cc434ea1f7354c2085352d54990b82718b418a3f6a5eb5c6b6f4d791217515c8ea0
TLSH
T10BD02B0C39A17D410B1A02C783D20AF0F14C46758CD7995C88552349382BD5AA6AB6D2
MD5 SHA1 SHA512 TLSH

Submit Download