dd3eb3f4fbd5208e8d6b3c54c1e36b4f6c3f0ef631dd730c77c46907590d0218

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_c4bf29f61621d4dfede69e51efe5d64f_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260710-1wpvzaby3m
SHA256 dd3eb3f4fbd5208e8d6b3c54c1e36b4f6c3f0ef631dd730c77c46907590d0218
MD5 c4bf29f61621d4dfede69e51efe5d64f
SHA1 bc2f381fed983fd9985d46237cbbe1a379018cea
SHA512 c03a12014f5ccf4d563ff09c08edfb2eba0dd518e56bd8b36ef42e864d4021a3e5a4051b0155f8c0228fd01b914ed289ab88c38b727bad291326f00e9ff0f1ed
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnEpKShL5hUNFyygmbWi0q7SD99D/0MjP:U6PCrIc9kph5Opj552NlgY6TX
TLSH
T15294D0343581C037E29316318AEADB662A3E7E355725A8C73BD467AE2E302D1E735347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5108	75A3.tmp

Executes dropped EXE 1 IoCs

pid	Process
5108	75A3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_c4bf29f61621d4dfede69e51efe5d64f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75A3.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5108	75A3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3276 wrote to memory of 5108	3276	2026-07-10_c4bf29f61621d4dfede69e51efe5d64f_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_c4bf29f61621d4dfede69e51efe5d64f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_c4bf29f61621d4dfede69e51efe5d64f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3276
- C:\Users\Admin\AppData\Local\Temp\75A3.tmp
  "C:\Users\Admin\AppData\Local\Temp\75A3.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-10_c4bf29f61621d4dfede69e51efe5d64f_elex_mafia_stealc_tofsee.exe AA5A063F7E2B99E41060E954A15C1476BDCD9B51D5A3DEA41DCEF05FE697ADAC9B9406DAFD8B9E855FA59431A3080758AE60934716A7F77B1F8649E6478CDD2E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\75A3.tmp
Size 412KB
SHA256 dfa5cfec65793569bf125d6b2d9374087dd5463f978c2e540679bc496ab719b2
MD5 438e5814cbc61494d7a4aeaa067cbb86
SHA1 49e461429666a43048ea7adfe843462fa1162cf1
SHA512 d19d80d1d2e7b524d4da94cfd0507a74d2b4d49629cb08e3950237df4bf29646452ab35ffda4d74f7b3a28c189ba2b4abe8b3b1ab283aa7030ad6b2a4eb60084
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn04ItDCTY+sW5yEj9Wd3MwxUOyo2SzhZ4BnWbTQ:U6PCrIc9kph5x6W5nWdcEyHAhjmh
TLSH
T1CC94E0343581C03AE1E215314AEADB76693E7E725B22A4C77BC467AE2E742D1E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads