761ea691be825b0079872ce2e2be3215d0794e4befb1d645426653e3a8943b28

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_fce5d005bed235529813709eb43c34fe_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260701-cdm2nad19v
SHA256 761ea691be825b0079872ce2e2be3215d0794e4befb1d645426653e3a8943b28
MD5 fce5d005bed235529813709eb43c34fe
SHA1 5a142bbb5e7b23b34031650fcd0cafe014cc6afb
SHA512 b7ccff0188f53f4a91398b95c1b8483206a30d82329888494757b8158808b7ed67e3989e2b490c4080ebb018619559c4037c56b08d3e57e036dc6036faeffe3d
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFJtmeGThAtTMe0fwL/m+RRegL62qHg:gZLolhNVyEWG1AtMvo/HL62qHg
TLSH
T12894DF257681C036E583013147F6E776253A7DA15B6264CBB3D83B3E2E703D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1772	C4D2.tmp

Executes dropped EXE 1 IoCs

pid	Process
1772	C4D2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_fce5d005bed235529813709eb43c34fe_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C4D2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1772	C4D2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 1772	2672	2026-06-30_fce5d005bed235529813709eb43c34fe_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-30_fce5d005bed235529813709eb43c34fe_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_fce5d005bed235529813709eb43c34fe_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\C4D2.tmp
  "C:\Users\Admin\AppData\Local\Temp\C4D2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_fce5d005bed235529813709eb43c34fe_elex_mafia_stealc_tofsee.exe 53160A797E97C782A9F29FACBB2772385E5BB73482A0FC602B742448F4293CD2CD8F8723AD4D89E98F384F3DE65D7BF4DF338475CDAE9A3FD68D7FD960B81567
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C4D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\C4D2.tmp
Size 413KB
SHA256 c58dbb4ce228d59e898f54e6bf95782456f4c3bc0d382b0b359372403facbb7a
MD5 512f644a99fdefd830e22ef212f04311
SHA1 697f0ee67fec6184517b782cf4d89a0cf5a017ca
SHA512 129a7e7cb3d3cd983c16086f0fc546f4e4dc9187cd1fb301529ebca88996c2e1f6e72dbde5026009f2ec3eef16039047546a188fb826e052fa23475e3e3bdb8b
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFIzWXUdgRZsHzjqfOFHUkrfe7WrNxlvb00ruqHg:gZLolhNVyEnKkgzXfqPrfIWrBbuqHg
TLSH
T1FF94CF2476C1C032D1A201304BF6D7762A3A7DB15B61A5CBB7D8367D2E703D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads