c32b2acf7e81e98f3624f8dfca5402c0bab03d048c778e13c5f6ffd22894cd2d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260702-vbmbfsfs5l
SHA256 c32b2acf7e81e98f3624f8dfca5402c0bab03d048c778e13c5f6ffd22894cd2d
MD5 ae660a8aa285fc37c4a65e134ebd3531
SHA1 ee097fa15aca2195bceedac220bebb350f1ca0df
SHA512 924359c032c8011f6fbf0eef9c3238030f227718f2c92bd42ea09cb09411c01f9683d6e438dbe5694e8c749b58a33e36665e373cc4333aabec21700e64be01f3
SSDEEP 12288:si4g+yU+0pAiv+FxWuU2uXbDE03QyQHZUITNVVxUlvjosTdcG93Dn:si4gXn0pD+F/vuM0WWITIlvjRhFJ
TLSH
T1DBC4F1303582C033E76705314BE9CB65657A78B58B2578CF7BD42B6A6EB42E2E234317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2264	5BA3.tmp
1952	2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5BA3.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2264	5BA3.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 2264	4564	2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe	88
PID 2264 wrote to memory of 1952	2264	5BA3.tmp	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\5BA3.tmp
  "C:\Users\Admin\AppData\Local\Temp\5BA3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe 501A15CBFDC5579764D99C5602B82397F32CC48FBF2D8BD50EA1D6C5F971B71CCD930653C2F7F8BC434DDEB8CF5F41C99EA8A612BC5887882CB62974BB8AEE4E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2264
- - C:\Users\Admin\AppData\Local\Temp\2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:1952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-02_ae660a8aa285fc37c4a65e134ebd3531_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5BA3.tmp

Path C:\Users\Admin\AppData\Local\Temp\5BA3.tmp
Size 535KB
SHA256 d3c422e93859ee33d60c99ab820969547fed24f4df764dd9f6f6173f681b13d6
MD5 ce8e915faebe6338e1ca4c6acf5e3ed7
SHA1 474d54643da2e30b41b663384c86ce5ffa9122d5
SHA512 db7280c867c19686c1bea0f65df461d8189a3ef25a728889cd71ae99c6ead1e46f9305599dc7cc1928cb5055544bd68de147138313aaba4b70b960f93a4f5b21
SSDEEP 12288:si4g+yU+0pAiv+iLiUvMDgFXQEQ8VixKX2llJxUlvjosTdcG93Dn:si4gXn0pD+B++aNpVixKXgmlvjRhFJ
TLSH
T1B4C401203592C033E1A715354BE5DB92667A3D764B26A8CF3BC42BAD2EB43D2D635307
MD5 SHA1 SHA512 SSDEEP TLSH