f7e807db0a007b4c57d7c1510c502d255cce19b7de7d603c90dbe36b73097aec

Analysis

max time kernel
148s
max time network
102s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 13:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_5691819a1aa3d1e4f0d29c08ed0183bd_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260711-qnth3sdt21
SHA256 f7e807db0a007b4c57d7c1510c502d255cce19b7de7d603c90dbe36b73097aec
MD5 5691819a1aa3d1e4f0d29c08ed0183bd
SHA1 95f7928752d1a38f7be05de81e64328610507512
SHA512 99e500949fce1e8d727332a9a032befc2110c9718ba0d06c13031401993e120542b77ebb8492c7e415f55dccb27ffc7d173325f605e42d4b6146c21338458ba2
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFbRIee3FsmUFczg/NoWcw22RsE4zIcUrYw9qHR:gZLolhNVyEiirFRENCw+zsYoqHR
TLSH
T1E294D025B2C1C036D1A301304AE6DBB5153A7DB15F61A4CBB7D8377E2E742D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4564	E94D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4564	E94D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_5691819a1aa3d1e4f0d29c08ed0183bd_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E94D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4564	E94D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 4564	2712	2026-07-11_5691819a1aa3d1e4f0d29c08ed0183bd_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_5691819a1aa3d1e4f0d29c08ed0183bd_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_5691819a1aa3d1e4f0d29c08ed0183bd_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\E94D.tmp
  "C:\Users\Admin\AppData\Local\Temp\E94D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-11_5691819a1aa3d1e4f0d29c08ed0183bd_elex_mafia_stealc_tofsee.exe D85B0BE32B52C457AE5EBE4C75ACE094EA2294D3A0B61DC844F1B4873970D1FB31CAB03E196391804DB89850B920168264B885C512F39B472F0430CEE488956D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4564

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E94D.tmp

Path C:\Users\Admin\AppData\Local\Temp\E94D.tmp
Size 428KB
SHA256 451993721d32e0d547a652a141caea0824300787206a1becb8b7509e878bd5e5
MD5 769e897036639ec4d6eef403b71433a2
SHA1 4b79eca9a4f211e94c5957abf7281b5fb0aaa604
SHA512 712021aec215dfe02d4821d6f88562c9b24fe68f25a258c6915754cba0388de256da20e14f9e7fc83055a320f0536e5f35010d956284569c1523b26622ae9d99
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFdaqHahWgSLlvxRgcgVO9rCpGXh1tU7xmqHR:gZLolhNVyEA4QgSL5xRSVY4UtsxmqHR
TLSH
T1EB94DF2872C1C032E19301314BB6DBB6193A7DA15F6164DBB7C8377E1E712D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads