1375f3d5b4b298e2c9f3d3c341f7d268208d82ac87117b9ba995e64bf5ccf8c2

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_e8f3db43cb46618eea7cbdf94cf205c6_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260702-tpem4aev8m
SHA256 1375f3d5b4b298e2c9f3d3c341f7d268208d82ac87117b9ba995e64bf5ccf8c2
MD5 e8f3db43cb46618eea7cbdf94cf205c6
SHA1 05b6ed54a41d3f49ebe48d1c9ba8a2932f4f60cc
SHA512 d1193ef7fc5f1d76746de501a7baa887cd4cae9ac8ffc05bd96b4494d2f2d375c93a996efaf99b6d1675ec8d078cb5aba2606651a437d3152f0643f57e933bbe
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFCVxG5TnbAcAgc6q0ilaqNrv3GiVkqH:gZLolhNVyERHG5A2feUqTWiyqH
TLSH
T10F94DF29B2C1C036D59300318BE6E736153A7DA15B66A4CBB7D43B7E1E713D1A63A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6516	77DB.tmp

Executes dropped EXE 1 IoCs

pid	Process
6516	77DB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	77DB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_e8f3db43cb46618eea7cbdf94cf205c6_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6516	77DB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3620 wrote to memory of 6516	3620	2026-07-02_e8f3db43cb46618eea7cbdf94cf205c6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_e8f3db43cb46618eea7cbdf94cf205c6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e8f3db43cb46618eea7cbdf94cf205c6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3620
- C:\Users\Admin\AppData\Local\Temp\77DB.tmp
  "C:\Users\Admin\AppData\Local\Temp\77DB.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-02_e8f3db43cb46618eea7cbdf94cf205c6_elex_mafia_stealc_tofsee.exe 46A61D54B09313A15DA192086D278E441AD0CBDAFC3104E929DBD738BC1011645F565B2F174AD162C7FD675B3FF0907A353CCFD2E31AADCF36489332AD2FA674
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

77DB.tmp

Path C:\Users\Admin\AppData\Local\Temp\77DB.tmp
Size 411KB
SHA256 0dacbffc7914977a6c0d7d179a3c644558a0febe30a263c00887474c9cd1af29
MD5 3fd303c31174b2af936c3f624dc6d7e7
SHA1 e4d317ef7dbb7209ea47d8170efec668461a3f3c
SHA512 065f914d3ac73652cb51733e07fe539a8f88356f698fc10a1b19c8dd3236cc5e3e78e7a97ca7582724c293c407a748f22cc464f9c8c4240bf01f8dd415a59cb2
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF3nkcNk6t74geNVaCde3wIqH:gZLolhNVyEmk6ag0sngIqH
TLSH
T12194DF28B281C036D18305314BF6DB76593A7DB55B61A4CBB3D43B2D2EB03D1AA7631B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads