cd8b18b82fe347b5f133196919abf090999832cb01a7623ce36ef594652a51a2

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260707-cdr1lsfx5s
SHA256 cd8b18b82fe347b5f133196919abf090999832cb01a7623ce36ef594652a51a2
MD5 9ec4b397804c965e2fe6e9a3b9c382c9
SHA1 61ef6992a8d2d53289caff02b942c01887934c35
SHA512 eda3ab7611e517e4a2bd43af6869933a9d855eb15ea601ec03a03aabf20eb7405b70174b38f109ef7205da09882fff99286f0b12b2d939c4466ad09ca3e52113
SSDEEP 12288:si4g+yU+0pAiv+tvdOLZRdfFxEf4RjnXqxUlvjosTdcG93Dn:si4gXn0pD+BwLZjUsFlvjRhFJ
TLSH
T1C0C4F1203591C033E26719354BF5CBA6A67A39B24716A8CF3BC02B6D6EB03D2D635347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5824	3687.tmp
868	2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3687.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5824	3687.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 5824	2888	2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe	87
PID 5824 wrote to memory of 868	5824	3687.tmp	88

C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Users\Admin\AppData\Local\Temp\3687.tmp
  "C:\Users\Admin\AppData\Local\Temp\3687.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe E5F4DAF9A91A41A4C2E0F5425B7677AB32DFBCBC2AC865B2AB52AB237CC08448A0866569DF113EB487BEA31D4560FC985A606E08DD8170AC2BF840D760E742A6
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5824
- - C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-06_9ec4b397804c965e2fe6e9a3b9c382c9_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

3687.tmp

Path C:\Users\Admin\AppData\Local\Temp\3687.tmp
Size 535KB
SHA256 efca8a6649d9b882275d814531ebf838253b87617632920adffedab76d7d91b8
MD5 2e4efa8c6618c0312c612b0f27c64295
SHA1 c25ea996eda954cd20e2e2bde5315ebe03403415
SHA512 8fe85a8b71eddb5ef8de2656beda794bb2855fc12a84c9e71e3931437e53f0beb22743d295e5d9b51efef077b8fb0d6ec89aef2dc56787b77a344b835eb1315a
SSDEEP 12288:si4g+yU+0pAiv+SZuGTEQljAK6Fjt0AtkgmxUlvjosTdcG93Dn:si4gXn0pD+Brwgt0AtkgZlvjRhFJ
TLSH
T111C4F1253191C033E6AB15354BE5CBB5667E78724722A8CF37C42BB96EB42D2933134B
MD5 SHA1 SHA512 SSDEEP TLSH