4eaf46e7f8bbf0bff3035de34eea6ed69a78a3525c1728320ca0ff117c7dce0c

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_3cdaa11832d9cd483b52ea39bdcbd8b3_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260701-vsdewaa12p
SHA256 4eaf46e7f8bbf0bff3035de34eea6ed69a78a3525c1728320ca0ff117c7dce0c
MD5 3cdaa11832d9cd483b52ea39bdcbd8b3
SHA1 09445d1f7c12a1bcf1eb4438a1854753c6b8213b
SHA512 8c0ff5148a981c580783827b0e48e97c572319cf9b8f3f4e1edb3936b73fbf13d256d4f8568032de44d7f60989935b0a4637b3ea9851288b5e89e0d9c23e7407
SSDEEP 12288:gZLolhNVyEfB10UxWHaVawVjgoyIpwQG5bqHR:gZqhOEfxxWKn0vIKQ1
TLSH
T1A294DF25B2C1C037D19305314ABAD7B1253A7DA15F6164DBB7D83B2D2EB13D0AA3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
672	FB72.tmp

Executes dropped EXE 1 IoCs

pid	Process
672	FB72.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_3cdaa11832d9cd483b52ea39bdcbd8b3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FB72.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
672	FB72.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3464 wrote to memory of 672	3464	2026-07-01_3cdaa11832d9cd483b52ea39bdcbd8b3_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-01_3cdaa11832d9cd483b52ea39bdcbd8b3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_3cdaa11832d9cd483b52ea39bdcbd8b3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3464
- C:\Users\Admin\AppData\Local\Temp\FB72.tmp
  "C:\Users\Admin\AppData\Local\Temp\FB72.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-01_3cdaa11832d9cd483b52ea39bdcbd8b3_elex_mafia_stealc_tofsee.exe AB88FE796EFFB19B3ADE6CE8648584145A506CA3E709AB9B3177C0725CE00597A9A993E87658642F984F3BEB86003560347E21C30ECA12DE4853EBDC1C7AC078
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FB72.tmp

Path C:\Users\Admin\AppData\Local\Temp\FB72.tmp
Size 428KB
SHA256 7691a9ef58d14dbad627577eb7e50254e22cbd38aec86558069929d2203cb9ca
MD5 17ea40e1b16374f18273571d9e6bf136
SHA1 b618e65840dac18a90792ed9d80061b2eaa1103d
SHA512 cb52789a4ca5b56a7c0689e3f132d123f58ef4ff9a1cc611c143d0c24d42a80d940e414fda2057279172023f0d92802d5a1da496b001bbc40a21a4731fa691f8
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFkAzhA0dhJyhHPGSoInuVl/jUXNM8/qHR:gZLolhNVyErAzhzh6GInS/jU9MwqHR
TLSH
T12394DF2972C1C036D19701304AFAD7B6153A7DA15F61A4CBB3983B7D1EB03D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads