9037a2659cacc7f1ea588346618cf4f0d8a083b68b7c0d16bfdcedc7bb138144

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 04:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260630-e8ed4se18l
SHA256 9037a2659cacc7f1ea588346618cf4f0d8a083b68b7c0d16bfdcedc7bb138144
MD5 b51802befe6434a9db7a4e37dc15c0d5
SHA1 946a851fa404e8a05f97dc318ace6115439e3c81
SHA512 a0e0c05bda2a638ddd297b730700a34ed5e2d46859aae0bd625a4ceebb81a1a3f851e9abaa227986eee7c63c93c87937472aba33bf0bd419742f299d9d310f4d
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHtmFVhBfVp6RRy6+CW00EvIyZ:Zm48gODxbzqvrATY0pvBZ
TLSH
T12184DF34B581C036D1A701314AF6EB62593B3DB24B6468C77BE43B69AEB13D1E63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1800	C687.tmp

Executes dropped EXE 1 IoCs

pid	Process
1800	C687.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C687.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1800	C687.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1500 wrote to memory of 1800	1500	2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1500
- C:\Users\Admin\AppData\Local\Temp\C687.tmp
  "C:\Users\Admin\AppData\Local\Temp\C687.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-29_b51802befe6434a9db7a4e37dc15c0d5_elex_mafia_stealc_tofsee.exe 248EBF6E4E7D6B36B9DFF5BFFDD897E619F92BDC3F82EF31300F6AE7A85B83409E0B8C4AA73CC688A08BCA91C1DA8FE40E7C96D6DC4CE51FFD6A05C21F73D0D8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C687.tmp

Path C:\Users\Admin\AppData\Local\Temp\C687.tmp
Size 384KB
SHA256 f14a2fe7b1336d616f2fa0a559c8fc7defdfcc5834666014d2def1a7f78d3942
MD5 3242caa6c843a4e7870ed03f903c0f98
SHA1 45b3be3022217eb973abcdfae4e4b4df5e4c052e
SHA512 3ef2af8dc690787a9ee7d52b2c8f02eb2264b1d6f1fd100e76a8694f89d0a3d6cb7d2c6cc699e2088f983b7eb54ee0cec59754762c016f06b1c0804f58051225
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHCviI9KTfpVUQjkztk66NcJHzsziZ:Zm48gODxbzI/ATf/okYVsziZ
TLSH
T10884D0347581C036D09605318BFAE7656A3B3DB24B2468C77BE47BAD9EB03D1A73424B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads