f8f0b2233b4e3db8d5d8cdbbe0bf2f237a1e1e90b52cdfbcff478689e09209ac

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260513-en
resource tags

arch:x64arch:x86image:win10v2004-20260513-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
11/07/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.exe
Size 12.7MB
Sample260711-xh5sgsbv21
SHA256 f8f0b2233b4e3db8d5d8cdbbe0bf2f237a1e1e90b52cdfbcff478689e09209ac
MD5 26ad383d9e965d92ffc83bfa1fd432b6
SHA1 3fcd76b4969e648d92ab5ccddf26199cd96840ac
SHA512 d98d739c3e62ae1b5de35a9d8ff75c01077f07cd50ee5ac632c81ea1e894aa2afc3b2910558824e3f31226923fc98eafb984c0c9ba868664435f2085731ead97
SSDEEP 6144:0btuAUl9S+pHmwJmFsXfGdNpKwttZYQDmFA+LOG9nEvpJamvLL0KsH8p:0SgcmFsXfGdfzYQCFA+Lu3BLLkcp
TLSH
T141D6E1227582C032E6E706754BE5CB65297ABE255B22B0CB779037AD6F703D1EA34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery persistence ransomware

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000\Control Panel\International\Geo\Nation	69B2.tmp

Executes dropped EXE 1 IoCs

pid	Process
3516	69B2.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69B2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3516	69B2.tmp

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	WINWORD.EXE

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	WINWORD.EXE
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	WINWORD.EXE
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	WINWORD.EXE

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3053180483-1881419501-3594244048-1000_Classes\Local Settings	69B2.tmp

Suspicious behavior: AddClipboardFormatListener 2 IoCs

pid	Process
464	WINWORD.EXE
464	WINWORD.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3516	69B2.tmp

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
464	WINWORD.EXE
464	WINWORD.EXE
464	WINWORD.EXE
464	WINWORD.EXE
464	WINWORD.EXE

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 3516	4664	2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.exe	86
PID 3516 wrote to memory of 464	3516	69B2.tmp	87

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012
Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\69B2.tmp
  "C:\Users\Admin\AppData\Local\Temp\69B2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.exe 5AA7D8044D500593A91FC283B1F70F7BFBFC85C0CC082D2BB129C13B6052674E7A1C362BF01EDB44CD7572C0656BF70466B07F9062877A8F814FCA09E3AC986E
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Modifies registry class
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3516
- - C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE
    "C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.docx" /o ""
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious behavior: AddClipboardFormatListener
    - Suspicious use of SetWindowsHookEx
    PID:464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.docx

Path C:\Users\Admin\AppData\Local\Temp\2026-07-11_26ad383d9e965d92ffc83bfa1fd432b6_elex_mafia_stealc_tofsee.docx
Size 21KB
SHA256 c97189b50e5e92be09966d4732b6d61a2e435b2935d60c09989e555ae442e7a1
MD5 7079891932a64f097abafd233055a1e9
SHA1 246d95feafe67689d49a5a4cadba18d3ac1914e5
SHA512 6e9ee6427d7cc2474dc634b088cf3f35d06dfb734d2b63fbbc794f4083b4b5754379daff4804bf5024b1b430aa5e50fa6d839d3473ceeed3043d373c85e9862a
SSDEEP 192:77LS5X71R5GIz5rLDeYg2o8zdl8kvZUGRKI/LpIuOBugbWaECZ3ls4:PLA1e85fzgpEX8kx7Tp+Bugb1ECzs
TLSH
T1D9A23A31AE2CBD9DE0767F7499BB57E1777BAF5E5C05C81A2C41330910B09480A686FB
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

69B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\69B2.tmp
Size 12.7MB
SHA256 7fe6e4d803832104e2f4264cc059fdaf5503c9cdaaa5faa75c0734bba7a5cbc3
MD5 2514cddfb4c0880e652fbb5315b526e2
SHA1 45a3cd805de6861b834d0ed1eed8778d643b60f6
SHA512 32efc34554a6cd0be35e238d791bd79185d3e38246a23dd12548180b1c7424e17bdbb1adb4b2c5d16e18cec7f45ffa89f4502d614c13aa325ff7df955a6ecf3f
SSDEEP 12288:0SgcmFsXfGdf6dMB+cKctI5r4rteb/uVOcp:0ShmeOf64+cntICrQDp
TLSH
T1C2D6E0227586C032E1A612B50BF5CB25593EBE765B23B0C77B9037AD6E703D29A71307
MD5 SHA1 SHA512 SSDEEP TLSH

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads