707c3895aec01e7627162718deab7c80026800b8a47644b485bfb785fcd404d7

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 03:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_a7495f046264d9d14be6d7397a23eb2b_elex_mafia_stealc_tofsee.exe
Size 526KB
Sample260701-d1bgtaft71
SHA256 707c3895aec01e7627162718deab7c80026800b8a47644b485bfb785fcd404d7
MD5 a7495f046264d9d14be6d7397a23eb2b
SHA1 8bd312d1cec0eb349f28a0f179bb86b23dbaedb1
SHA512 1a2eb913905cc4478420324a56f8de1b484b1489aa25e83aee65772c082fa6465c2a3a2dfd0d516c36655b8cbe23f22930c7dd7415a58bd9f69b2ef231eebd08
SSDEEP 12288:z6PCrIc9kph5vYrLmz2D6NteiA/DAMj5wz:z6QIcOh5+ljS
TLSH
T1C5B4AE385485D2B6E2A383399CEDE69E4834F101173A70E7A3DC07AD59BDAD05F3960B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4744	C82D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4744	C82D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_a7495f046264d9d14be6d7397a23eb2b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C82D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4744	C82D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 4744	1884	2026-06-30_a7495f046264d9d14be6d7397a23eb2b_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_a7495f046264d9d14be6d7397a23eb2b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_a7495f046264d9d14be6d7397a23eb2b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\C82D.tmp
  "C:\Users\Admin\AppData\Local\Temp\C82D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_a7495f046264d9d14be6d7397a23eb2b_elex_mafia_stealc_tofsee.exe 7EF0A2A2478947640DED31A84D2E0697B3C4FE1FF3FD3C393DBD32F1A0963DB3976F893F8A51184A68C933EE75225067A6051912BD0B233D9880591B26E12B08
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C82D.tmp

Path C:\Users\Admin\AppData\Local\Temp\C82D.tmp
Size 526KB
SHA256 5146b62342abb5ce2b9045237da9e271b33abc891907196b62f3b03409d163f9
MD5 1684263c1086bd89e192b3d6d6833275
SHA1 dd7afe9ba042698a2a9c173a854d0ac5ec72deff
SHA512 77556582071692af9ce3cfbe4d021a2afd5eb036c19bd557d4a2186ddcdfea6dc998cc42f6bc829907c4ea10dcf37ef912ed6820dcedc1389797d472933d0918
SSDEEP 6144:zooTAQjKG3wDGAeIc9kphIoDZn5orKDZu9tcc63+m+5Im/323bPN8dwrP6+:z6PCrIc9kph5tdItmpW2LN8dwrz
TLSH
T186B4AD385585D2B6E3A283389CEDF68D4834F111173A70E793DC07AD99BDAC15E39A0B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads