7b865b42d4437ae697a9167226fc6ac9da4f1e7e860d0b2a6728ca1002819cba

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5a93cc92afbccd9733e2a3611000c869_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260628-2b5lcsft8y
SHA256 7b865b42d4437ae697a9167226fc6ac9da4f1e7e860d0b2a6728ca1002819cba
MD5 5a93cc92afbccd9733e2a3611000c869
SHA1 28b088fa77bfa997652e4dcfc687aad58520141d
SHA512 edfc47e60efac648080cc8554eb3025543e57fc2e6d4e3ac8081c618dc1cffde84fccf8ed4a1173a1c071764e2ff24fc96ba630c8ea1c8d31f03135940a01849
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFS0te5yPiAjzYCm8SGqnBgwFTGBJ0KdBqHI:gZLolhNVyEp0dv86uBgwIJBBqHI
TLSH
T16494D024B6C1C032D59305304BF6E676193A7DB15B6164CBB3D43B6E2E713E1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4208	DF10.tmp

Executes dropped EXE 1 IoCs

pid	Process
4208	DF10.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5a93cc92afbccd9733e2a3611000c869_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DF10.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4208	DF10.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4420 wrote to memory of 4208	4420	2026-06-28_5a93cc92afbccd9733e2a3611000c869_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a93cc92afbccd9733e2a3611000c869_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5a93cc92afbccd9733e2a3611000c869_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4420
- C:\Users\Admin\AppData\Local\Temp\DF10.tmp
  "C:\Users\Admin\AppData\Local\Temp\DF10.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-28_5a93cc92afbccd9733e2a3611000c869_elex_mafia_stealc_tofsee.exe 9ACE7D1AB123DF6AA61DF563C5FB43CE872061931FEBC8FDA5C0F08B0034D6017DAB5436949FEC3B516F0614D54D9764FDAB3E71369A114F4A65D5F0E247AE88
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DF10.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF10.tmp
Size 411KB
SHA256 10ca3cac7f0339c04cb01a5d2de37102020c41f98787543ce68c3302ba7b9546
MD5 cb794e4374d393bae248a642f0231842
SHA1 8c409efc42f0a08ca876b4f1d42766ed03ed7e95
SHA512 52f6ceb2aaa98a97111d05b70e3abf2b194a2e3631d4f6110f68e70907d6d81c07724c39e2a2a2f22d4d5724aa9156b80c9a1dc8f354dfe26b9110e29720e91d
SSDEEP 12288:gZLolhNVyEjQWyc+W7WMvypLcBJDirhwaqHI:gZqhOEEI7WMvyoJDirhwE
TLSH
T1AD94DF24B2C1C036D19305314BA6D776193A7DB15B6264CBB3983B7E1FB43D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads