9776dd8cd24eec38a0c3fccea8417293259fa56784cf9deb4fed0dca512cbb8b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 05:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_2be4ad0760e19cfbfa4706076ef2df13_elex_mafia_stealc_tofsee.exe
Size 531KB
Sample260701-glht5afs7j
SHA256 9776dd8cd24eec38a0c3fccea8417293259fa56784cf9deb4fed0dca512cbb8b
MD5 2be4ad0760e19cfbfa4706076ef2df13
SHA1 7562e224d0509062e6d6b9ef1186d3e46e2548c2
SHA512 bf3e7614d2068037ce8367864c379f10b7db31acc5238f787e900e48b7fda0373ad47917d85c53ac617161fddef5c185faa1b68e435c6421a53246deca3ac70d
SSDEEP 12288:gZLolhNVyzA0BFSnFCdSS3wAq06qNazzb4Dn4LcmT4nNBb:gZqhOzA0BFSFCrhZMzzb4Dn4LcmT4nNJ
TLSH
T105C4D02AB2814232C18301711BABDAA6773E7DB5177594D372AC712D1B72BE0A37B347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4928	D84A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4928	D84A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_2be4ad0760e19cfbfa4706076ef2df13_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D84A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4928	D84A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5044 wrote to memory of 4928	5044	2026-06-30_2be4ad0760e19cfbfa4706076ef2df13_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_2be4ad0760e19cfbfa4706076ef2df13_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_2be4ad0760e19cfbfa4706076ef2df13_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5044
- C:\Users\Admin\AppData\Local\Temp\D84A.tmp
  "C:\Users\Admin\AppData\Local\Temp\D84A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-30_2be4ad0760e19cfbfa4706076ef2df13_elex_mafia_stealc_tofsee.exe 79CE194E09EC31D12131CA758061BB463B0EA34761A63D29C24D3530B785C511C78444368424FD5B76FFC9538366838DD3D9C60DD976DEF88F959E54C4A2F854
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D84A.tmp

Path C:\Users\Admin\AppData\Local\Temp\D84A.tmp
Size 531KB
SHA256 ae48202ee9e556b353f21ed94a9b078daeb87a061238ee3c4fadb5905a3acf6a
MD5 3d4e6e61c1524746f07805dd97709c9f
SHA1 2ca37f17f8a378d1ebfaf564b1fe60e64baf3810
SHA512 76a4593af7ac2b553e21d309593b6f29ca28a733b535b76d9818deb469ccc0f4c3ad4467fd1b83424692d6fd55c8c6b5d1b0bc0fc67e38017f87029101842aa0
SSDEEP 12288:gZLolhNVyz9vcrccMjGd4OCh6ZnKNgQqNazzb4Dn4LcmT4nNBb:gZqhOz9crcXCWOlKNtzzb4Dn4LcmT4nD
TLSH
T170C4C02AB2818332C18201711BABDAE2773A7D75577554D372D8713D2B72BE0A37B34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads