f7aac8310876eae26e23b56e38efff24fc40daa03ebd17cc155a66c3fb112175

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_324e2a0919fc7ef717ecb94915dd93ee_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260713-2vqljsct7t
SHA256 f7aac8310876eae26e23b56e38efff24fc40daa03ebd17cc155a66c3fb112175
MD5 324e2a0919fc7ef717ecb94915dd93ee
SHA1 742b0389725f28f9bd1d62a6ff3d40ace0978f96
SHA512 b3c4baa21da21b8fa7fef978cb2898fad22e6f26e171df7ddb3d11288108684169f17c243bb5825c3d32391547e1d0a3653776a50d6fbb070d681923abd21fa1
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHZtaoSsyKwmd06eIBQMHgIOqMw2Z:Zm48gODxbzXtaoNyKwm0gPAPZ
TLSH
T1B884D02475C1C037E59601314BE9EB622A3B3CB28B2568C777E47B699FB03D1A73424B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5024	11B9.tmp

Executes dropped EXE 1 IoCs

pid	Process
5024	11B9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_324e2a0919fc7ef717ecb94915dd93ee_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11B9.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5024	11B9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3328 wrote to memory of 5024	3328	2026-07-13_324e2a0919fc7ef717ecb94915dd93ee_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-13_324e2a0919fc7ef717ecb94915dd93ee_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_324e2a0919fc7ef717ecb94915dd93ee_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3328
- C:\Users\Admin\AppData\Local\Temp\11B9.tmp
  "C:\Users\Admin\AppData\Local\Temp\11B9.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-13_324e2a0919fc7ef717ecb94915dd93ee_elex_mafia_stealc_tofsee.exe 6D4D40897C6918B2AC547010FEDED559FB0E1BBE83BD70DA3F4D0C20B0052B3AC7FE33045FFFC5115158544853871684C6E513146A26095EA6307260620091BF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11B9.tmp

Path C:\Users\Admin\AppData\Local\Temp\11B9.tmp
Size 384KB
SHA256 1ff39c6ce76c65f2b14e9e3ad8a6c92c1fcd418182f310abc44ba56e134ab051
MD5 594c9163f7ce38cedc00553a2b969ea1
SHA1 c7f4d31d48d12af4072928c9bd42af131dbd71ab
SHA512 54c7e6ce4e0bb31ade2bc37fe5f6121ed6739a2d9ea9d5ad782776f987932f2a3bf0b7a96fc68053e76666201ca62b192142e5dcd5b4c0fc39dcace13c65283d
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHvwetmIZNJFHoiB5AjCmfRLXy5CoPunRVEZ:Zm48gODxbz9wIZrtMegRLoCuARaZ
TLSH
T1F384CF34B581C036E19701314AFADB611A3B3DB64B2568C77BE47B699FB43D1A73820B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads