3961b1c1ff9315b10d08a13c7ebdf90dabf1e529d52762a3fbfad1f64ec48de8

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 04:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_67eb135e072e605e233fff8ba8495919_elex_mafia_stealc_tofsee.exe
Size 526KB
Sample260701-e7qezset8n
SHA256 3961b1c1ff9315b10d08a13c7ebdf90dabf1e529d52762a3fbfad1f64ec48de8
MD5 67eb135e072e605e233fff8ba8495919
SHA1 b4de9a7eef8178072a0c9374c79c63d38c2ef0fd
SHA512 49e3511ddb45bc8af337dfe087814e72ca3826f726bb2454162f5688b9484397b60da883b2048d8217c7d57c2153f1f633928160740451a8631bbb832dd368a8
SSDEEP 6144:zooTAQjKG3wDGAeIc9kphIoDZnoU9FOu/uVMa76gHp9byScIHYBX183NAJXzTP6+:z6PCrIc9kph5fF0Vt7iSE1fJXzjz
TLSH
T146B4BF385585D2B2E2A283389CEDF68E4834F111173A74E793DC07AD5ABDAD05F3960B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5892	ED88.tmp

Executes dropped EXE 1 IoCs

pid	Process
5892	ED88.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_67eb135e072e605e233fff8ba8495919_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ED88.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5892	ED88.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 5892	3976	2026-06-30_67eb135e072e605e233fff8ba8495919_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_67eb135e072e605e233fff8ba8495919_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_67eb135e072e605e233fff8ba8495919_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\ED88.tmp
  "C:\Users\Admin\AppData\Local\Temp\ED88.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_67eb135e072e605e233fff8ba8495919_elex_mafia_stealc_tofsee.exe 07D133532164FE16CD97D7104B0F9894B45E72626156A9D27913A2E3A018C1306E019938193618B917BCBB81B612A3CB93D628A628933B88162674C1BC379CD2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ED88.tmp

Path C:\Users\Admin\AppData\Local\Temp\ED88.tmp
Size 526KB
SHA256 01426f3460b08b7ef8058d85a952274a3c1967a835ac5daaa6f1fd1f38f8a831
MD5 70111d5e77b04d2e11f91722f4ac6cb9
SHA1 82f415f907aee089ea888c67bdd02d2aaf2ecb84
SHA512 f929b619cb28850fb664ce9cd6915c524801e95ab4f5344451e79d26a4f653d99e16cd1e2b722596903ff47cc845dd5dcb8f27d125a2075a291adb095551a2ff
SSDEEP 12288:z6PCrIc9kph5SyVYa4DXaGuP01sQalcjz:z6QIcOh5zYtyPusflk
TLSH
T1F4B4AE385185D2B5E2B383398CE9E68E4C39F111173970E7A3DC07AD5ABDAD09E39607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads