Analysis
- max time kernel
148s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260629-en - resource tags
- submitted
30/06/2026, 22:51
General
- Target 2026-06-30_4ae1e5cc2992093270f1a5e95c7e0c1a_elex_mafia_stealc_tofsee.exe
- Size 448KB
- Sample260630-2s5mpabs2x
- SHA256 227256a96264be5da471dd78f8272c621e2d47a6acef9ba9f479539c3b13c19d
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-06-30_4ae1e5cc2992093270f1a5e95c7e0c1a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-06-30_4ae1e5cc2992093270f1a5e95c7e0c1a_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AFB3.tmp"C:\Users\Admin\AppData\Local\Temp\AFB3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-30_4ae1e5cc2992093270f1a5e95c7e0c1a_elex_mafia_stealc_tofsee.exe 9E27ACCD56B6A5E4ABF90F6455979B68954DD1F98ED7725F94EFD3B1DA49AA7C5E315A46CD38182FA7DD02D2626866A89512474CA75E80B384218CE854E58F432⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
AFB3.tmp
memory/3868-5-0x0000000000940000-0x00000000009B9000-memory.dmp
memory/3868-8-0x0000000000940000-0x00000000009B9000-memory.dmp
memory/6020-0-0x0000000000A00000-0x0000000000A79000-memory.dmp
memory/6020-6-0x0000000000A00000-0x0000000000A79000-memory.dmp