f3112268def80288bbf7a2b38630871de2b91a0a2e0911b290fc91de8ae68e61

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_8ca93f4a8b2c376a95f14a73fb94b94d_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260710-2afwlscx3k
SHA256 f3112268def80288bbf7a2b38630871de2b91a0a2e0911b290fc91de8ae68e61
MD5 8ca93f4a8b2c376a95f14a73fb94b94d
SHA1 1f7d12edc21ba949a171d014384093aee6411e30
SHA512 d53102155459de0d9e0f8c72d0f2d1d78b457bafd9ef2d71a74edfaca1aa923bde8c7439a1cb43165f3f50ac3413c36cd9158c043368567a9faa6a2839bc89e7
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHTlxPe2gwtppbT+rH4DGoQOD0HjnZ:Zm48gODxbzV2mtpyTTOGTZ
TLSH
T11C84CF24B580C036E19701314AFAE7612A3A3DB2576468D77BE47BAD9FB13D1A73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3876	8A64.tmp

Executes dropped EXE 1 IoCs

pid	Process
3876	8A64.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_8ca93f4a8b2c376a95f14a73fb94b94d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8A64.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3876	8A64.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 3876	2204	2026-07-10_8ca93f4a8b2c376a95f14a73fb94b94d_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-10_8ca93f4a8b2c376a95f14a73fb94b94d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_8ca93f4a8b2c376a95f14a73fb94b94d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2204
- C:\Users\Admin\AppData\Local\Temp\8A64.tmp
  "C:\Users\Admin\AppData\Local\Temp\8A64.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-10_8ca93f4a8b2c376a95f14a73fb94b94d_elex_mafia_stealc_tofsee.exe 00344FC41C173057C94B43A5DF9FBF9E5C5CABBDA9A5B38E370F533F4BE5E6F4A99C248AB07AE9D27496E800F273D706DFA08D2F4A9072FC116A5EF2A668275C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A64.tmp

Path C:\Users\Admin\AppData\Local\Temp\8A64.tmp
Size 384KB
SHA256 23af37ec46d7b5ef9287d290760bcc97fbec58caf8e37a27566f7d7c43a24d1a
MD5 d49f81bcfddbdd960a2500ec0d927c36
SHA1 f5a09df5c662adf0076ba73162ac35f3aa4febbe
SHA512 a57fa764079f86c09c514bbe1144aea027f875527efc323093d1879d434bf1d60f3ba7d793c248d84f88b29abd21d68fe61362afbfe24b06e5aab5ed4a3e5a28
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHEdnwK69f3GvPmCm4HB8++cRx3R4Z:Zm48gODxbzcnwKF+CmWG++cRx6Z
TLSH
T19C84D0247284C036E19605318AF6E7611A3B3DB65B6568C77BE43BAD9FB03D1B63430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads