db93f0ddc75251bfb8145138f6fba04a2ce92127bbcd1b2baa45cd907bb58c75

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260701-py9glsev2r
SHA256 db93f0ddc75251bfb8145138f6fba04a2ce92127bbcd1b2baa45cd907bb58c75
MD5 ed7381af4c0d0646d26eb50cae5a17f1
SHA1 af4787aeb0771a1d6c76e717c671edbbf331437f
SHA512 9f0223cc9776a3510bc99258779d87c9cd9195a1c3c28342b210c6e0a74563a5b8b51356e391dcaa548807d7fcea6b309e423a4e531c9d61fa6172a3cd119f64
SSDEEP 12288:si4g+yU+0pAiv+mXV7fUGEDowkzNvCe6FkRMVhxUlvjosTdcG93Dn:si4gXn0pD+87MGPwk5vB9PlvjRhFJ
TLSH
T1D4C401203455C037E6A721354AF9CBA6667B78724729A8CF3BD42BAD2E703C2D635307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4196	E181.tmp
2532	2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E181.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4196	E181.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 4196	2332	2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe	88
PID 4196 wrote to memory of 2532	4196	E181.tmp	89

C:\Users\Admin\AppData\Local\Temp\2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\E181.tmp
  "C:\Users\Admin\AppData\Local\Temp\E181.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe 5B6F1249BD61D4BF0F5FDE0A627D2C4E15B9C1478485635AE1540D155977B5182C61601CDE4DF151962FF0885DFF30F43DDD0EA69C119784E738AEE948DCE08F
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4196
- - C:\Users\Admin\AppData\Local\Temp\2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:2532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-01_ed7381af4c0d0646d26eb50cae5a17f1_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

E181.tmp

Path C:\Users\Admin\AppData\Local\Temp\E181.tmp
Size 535KB
SHA256 486adb5929832c29502ab881da9c951e41934ddb8f859c722ea51d0d339b9532
MD5 36ed0f4236bf3872a72ed7e96599196f
SHA1 340a68be950f9890ab112ddeedbe1572977888e4
SHA512 9a84d968f12b492b987ec1ce5e75fbb4e97490830721726b4211126ed7a5418ce644849db550ac9d9e3aefcbd2a5f552fcf34fe0ba7482e82e9bbb80087c6b91
SSDEEP 12288:si4g+yU+0pAiv+kRZseQYOHbaGF6vYK8elGvxUlvjosTdcG93Dn:si4gXn0pD+bYO7aVvYK1lFlvjRhFJ
TLSH
T131C4F1243542C037E2A705358AE9CB66667E39764726A8CF3BC42B6D6EB03D2D734347
MD5 SHA1 SHA512 SSDEEP TLSH