4e6a67ec336fa04c06a6089c6814cf71f4702e86bc1045486ce3f9ed71b63359

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 19:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_be489a9b2955334d6a318981ae14d838_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260628-x4nfbsds2p
SHA256 4e6a67ec336fa04c06a6089c6814cf71f4702e86bc1045486ce3f9ed71b63359
MD5 be489a9b2955334d6a318981ae14d838
SHA1 ec29b35cacdd6170c240ae01ddd822f30c1f241b
SHA512 f9e246fc7f0280cfe2d3e9a122b1ca119e967abb3731193113e7057f13c67f7281185812a3ffa52562957ee204a1c9b6f6ba843ad1e12e870741d2012b293a9a
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn8PhFk+5nA8qJftuLIr4WHtZ74tOMP:U6PCrIc9kph5uPhFbt8r4qtmtO8
TLSH
T13494E0243681C037E1A316348AF6DB661A3E7D755B21A8D37BD46BAE1E702C1EB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3204	A37.tmp

Executes dropped EXE 1 IoCs

pid	Process
3204	A37.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A37.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_be489a9b2955334d6a318981ae14d838_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3204	A37.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5800 wrote to memory of 3204	5800	2026-06-28_be489a9b2955334d6a318981ae14d838_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_be489a9b2955334d6a318981ae14d838_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_be489a9b2955334d6a318981ae14d838_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5800
- C:\Users\Admin\AppData\Local\Temp\A37.tmp
  "C:\Users\Admin\AppData\Local\Temp\A37.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-28_be489a9b2955334d6a318981ae14d838_elex_mafia_stealc_tofsee.exe D94A87B88D5E11DF9BA3F6AAD4290953093A1565A829B1B9DDC586DA23BC2B1B60DD14AD5DEB2FEF628F24410CAB609D381C59820495D81FDF3B2D2123DC48E7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A37.tmp

Path C:\Users\Admin\AppData\Local\Temp\A37.tmp
Size 412KB
SHA256 0db1d4900d9a7c1d075f7f25f3f512f5ea5d91d2076ce2694535357ec09077a1
MD5 3e513c66be5fca57ee9ab094e393893a
SHA1 b7229b5371d998153583731c24331ef49af7a4a1
SHA512 8a552d31008fdda6eef90b2ea739d90039226159caa9d11ba98830538300e7432f3bdc19f1a5c22cfc3511c2cc8a42f0363e0b3476f151a63e3dcde6de0cef63
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnNufw6ork6Li5qTIUWzFTcikbX0AAP:U6PCrIc9kph5WhopLOqTMwiE8
TLSH
T12D94E0243681C036E1D315344AEADB66193E3D755B22A8D73BE46BAE6E703D1EB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads