2cf1329fa9db7f6db05472a7eca7de4389a235062d9333cc3ab1fbcd89eee155

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 03:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_b95cf2f750dad2cb5f4d7ff90fedd9ea_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260629-d22emacs5v
SHA256 2cf1329fa9db7f6db05472a7eca7de4389a235062d9333cc3ab1fbcd89eee155
MD5 b95cf2f750dad2cb5f4d7ff90fedd9ea
SHA1 2e81b0a3b7eab0bf62bb2d7087b5a2e42df36631
SHA512 ea394851939a2deb6776c4a1ee3391b6e922e4694e4317b45be1e98ff04203440f9ae2d1ad18989493b555931a9a348cef43cd8116d1963da5fe02a86768a01c
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFN2eu8Cb3AZVX3cVdH7u+B2rqHI:gZLolhNVyEO2t8Cb3Anc21qHI
TLSH
T11794CF24B2C1C036E19604344BE6D776593A7DB15B6264CBB3D43B7E1EB03D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4424	C60A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4424	C60A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_b95cf2f750dad2cb5f4d7ff90fedd9ea_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C60A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4424	C60A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3784 wrote to memory of 4424	3784	2026-06-27_b95cf2f750dad2cb5f4d7ff90fedd9ea_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_b95cf2f750dad2cb5f4d7ff90fedd9ea_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_b95cf2f750dad2cb5f4d7ff90fedd9ea_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3784
- C:\Users\Admin\AppData\Local\Temp\C60A.tmp
  "C:\Users\Admin\AppData\Local\Temp\C60A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-27_b95cf2f750dad2cb5f4d7ff90fedd9ea_elex_mafia_stealc_tofsee.exe AA5F28A68C0943E7FF1E7748A0E4DEBC34C679F4522E1B094743631A14F7797629510B27067F68A76964BB682B44818E4D7DE9B4EB02FF3628FFD2DC66C79A43
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C60A.tmp

Path C:\Users\Admin\AppData\Local\Temp\C60A.tmp
Size 411KB
SHA256 f6f41afd6aa30c913890675092419818bc5ee031b27e55ff7f84312ffa47acae
MD5 aebe6ed92c266d50875e9c184f96826e
SHA1 73bc9a6c728ce94fb48330f9a466017cc29bcc4f
SHA512 99e58bc99c1fb126e7e6803928913d77e3aaa1573e5bb38b73a192913e27659a62f764c84e9e27ea20e5b23ce071933c6ce859dca3b637d68fa169f58730d9d0
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFPC7KqGg0Tmt20eoMgtVkJ2y/qHI:gZLolhNVyEZu5g0a20estVkEiqHI
TLSH
T1F494CF29B281C036D19301314BB6D776153A3DB15BA1A4CBB3D83B7E6E743D1AA3631B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads