1fbc56926d4fa38b33c2a2c1b82453034bf57c4a52130a5539559b5101756599

Analysis

max time kernel
148s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_aa217b2e4ce9865ade3c772f45c0a7af_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260714-ltdbtscx7x
SHA256 1fbc56926d4fa38b33c2a2c1b82453034bf57c4a52130a5539559b5101756599
MD5 aa217b2e4ce9865ade3c772f45c0a7af
SHA1 0d99c831dc8a9f9360f2671ce6dd11a83850ade9
SHA512 25ce28416aaaadf1198c1560f68b6cc8619936b7c68643ee1071286a130893e7a39ae5b235257e75a81212f4a62a7e9b70df7ab5ee44374808f12788d3defea2
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFtRirsOCL5EUKuiXOLRjtXEqHR:gZLolhNVyEfU5vKuDLPXEqHR
TLSH
T1F494DF24B2C2C036D1A301354AB6D7B5153A7DA15F7164CBB7983B7E1EB03D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4376	23F9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4376	23F9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_aa217b2e4ce9865ade3c772f45c0a7af_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	23F9.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4376	23F9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4308 wrote to memory of 4376	4308	2026-07-14_aa217b2e4ce9865ade3c772f45c0a7af_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_aa217b2e4ce9865ade3c772f45c0a7af_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_aa217b2e4ce9865ade3c772f45c0a7af_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4308
- C:\Users\Admin\AppData\Local\Temp\23F9.tmp
  "C:\Users\Admin\AppData\Local\Temp\23F9.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-14_aa217b2e4ce9865ade3c772f45c0a7af_elex_mafia_stealc_tofsee.exe 45B597371C5A0F2E58BB935AFDB26320DC1EDFBC8ABEF513FC4ECA220D577558395B0AF543BF54251BC82F2BC540CFBF51D931C154E4E63561A2442E69D7359B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

23F9.tmp

Path C:\Users\Admin\AppData\Local\Temp\23F9.tmp
Size 428KB
SHA256 d5fbf1d9b26afa30de1c9378e5310b8f75eb8228d2d0e69c0d8b203fec230a76
MD5 bb9db1a4225e947a47e2d971a89d1cd6
SHA1 e8ebd62c240f28f252a8053c58b0e2bf7477d69c
SHA512 74f14f885b96da6dcc00f715c9f142c7bca93c8ce8a57dbc9c1284386f069da068e7445d2b32f2a1d36cf6bbf63d34d88e6574cfe437dee201514956d7088c1a
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFR4UbxCuMblzICTpnpIsEkNOVYbVUajqHR:gZLolhNVyEc4Ubg1lzR1pxEctlqHR
TLSH
T18394D029B2C1C036D19301314AFAD7B2153A7DA55F6564CBB7D83B7E1EB02D09A7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads