40353e61a9a4f368d99ae38ffd296a02f984ab708288a1ebc0d400e2d8505e3e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 08:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_6adedd6ffadeb410816b27333a6ca1b6_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260630-kdkwasbs2k
SHA256 40353e61a9a4f368d99ae38ffd296a02f984ab708288a1ebc0d400e2d8505e3e
MD5 6adedd6ffadeb410816b27333a6ca1b6
SHA1 1873fab7d18181dbcb1b466ba84d494c36f37b61
SHA512 eb2e94df6d6ce5e2cffd8a378025d8575065e058476b95e43d5796415c9539b42be9a62e0a56fae10409101047da31f84f35e216aab28710efbd242fc101a702
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnc3Iqy2PTrpKtx3G5a2suMmAK4/lZg3Y8WNI1PT:U6PCrIc9kph56Yqy2Psk5aS4/T4RAqb
TLSH
T1CF94D0347580C036E6E306318AE5CB66293A3D754B62A8C77BD45BBD2E703D1AB39347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3456	1EF8.tmp

Executes dropped EXE 1 IoCs

pid	Process
3456	1EF8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_6adedd6ffadeb410816b27333a6ca1b6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1EF8.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3456	1EF8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 3456	1052	2026-06-29_6adedd6ffadeb410816b27333a6ca1b6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-29_6adedd6ffadeb410816b27333a6ca1b6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_6adedd6ffadeb410816b27333a6ca1b6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\1EF8.tmp
  "C:\Users\Admin\AppData\Local\Temp\1EF8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-29_6adedd6ffadeb410816b27333a6ca1b6_elex_mafia_stealc_tofsee.exe 509386490CD9BFC82C1958C1A6C62BA962F190920FB54B08B75E97B03E40044BBD49C454EC373596069DB8F0A73DC6A148098FE58D187AD5BF76D51C11BD891E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1EF8.tmp

Path C:\Users\Admin\AppData\Local\Temp\1EF8.tmp
Size 412KB
SHA256 b3dfd9121fc0b3d7e56ef43d537f4906346f72cc8d1a60e03ff76d91994fae22
MD5 7b9417cd404fc2ec716f2a83c1e029f4
SHA1 a0386f37ab9641da7c1205bf8e176df034805711
SHA512 14ec6d9742a68dce530a76d7c73ca057dc7b76536f7794541f9244b4b7158536b3f3a834e1c7904fda1b9fce46313db2da87339d73f01ba51a9d2761c982e5f5
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnkGjqXPWgbh4aY3mVzZTEytLgjuquOXlpHkEP:U6PCrIc9kph57iPWgb5Y3Ez1LgdWE
TLSH
T1DA94D0243581C037E1A706344AEACB66593E7E354B22A8C77BD46BAE6E713D1E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads