Analysis
- max time kernel
149s - max time network
138s - platform
windows10-2004_x64 - resource
win10v2004-20260911-en - resource tags
- submitted
12/10/2026, 15:21
General
- Target 2026-10-11_98995d1198de458a11abe8afd6d40272_elex_stealc_stop_tofsee.exe
- Size 931KB
- Sample261012-srgd2adh99
- SHA256 48cb161fd85b862118dde6d7ab0b4b7308847b27f9941dcc9031f272ae05390a
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Reads the TCP/IP host and domain name from the registry 1 TTPs 2 IoCs
The configured hostname and DNS domain identify the machine and are commonly collected to profile a host before it reports in.
- System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-10-11_98995d1198de458a11abe8afd6d40272_elex_stealc_stop_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-10-11_98995d1198de458a11abe8afd6d40272_elex_stealc_stop_tofsee.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4D50F4F8\BlueStacksInstaller.exe"C:\Users\Admin\AppData\Local\Temp\7zS4D50F4F8\BlueStacksInstaller.exe"2⤵
- Executes dropped EXE
- Reads the TCP/IP host and domain name from the registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7zS4D50F4F8\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS4D50F4F8\HD-CheckCpu.exe" --cmd checkHypervEnabled3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
C:\Users\Admin\AppData\Local\Temp\7zS4D50F4F8\HD-CheckCpu.exe"C:\Users\Admin\AppData\Local\Temp\7zS4D50F4F8\HD-CheckCpu.exe" --cmd checkSSE43⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
backicon.png
change_click.png
close_red.png
custom.png
discord_icon.png
discord_icon_hover.png
exit_close_click.png
folder.png
help_icon.png
info_icon.png
installer_bg.jpg
installer_logo.png
installer_minimize.png
loader.png
logo_text.png
minimize_progress_click.png
setpath.png
BlueStacksInstaller.exe
BlueStacksInstaller.exe.config
HD-CheckCpu.exe
JSON.dll
i18n.en-US.txt
ThemeFile
installer_bg_2.jpg
installer_bg_4.jpg
installer_bg_7.jpg
memory/1228-144-0x000000001B700000-0x000000001B768000-memory.dmp
memory/1228-156-0x0000000020AA0000-0x0000000020AAE000-memory.dmp
memory/1228-155-0x0000000020AE0000-0x0000000020B18000-memory.dmp
memory/1228-152-0x000000001E540000-0x000000001EA68000-memory.dmp
memory/1228-170-0x0000000022030000-0x0000000022038000-memory.dmp
memory/1228-149-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/1228-150-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/1228-181-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/1228-184-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/1228-183-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/1228-182-0x000000001CF10000-0x000000001D02F000-memory.dmp
memory/1228-142-0x0000000002DA0000-0x0000000002DB0000-memory.dmp
memory/1228-141-0x0000000000B30000-0x0000000000BD4000-memory.dmp