ddaaf37f18b153df7261df2c24c1e7c748c309c5acaef1db5ab8f64461c561c3

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 11:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260715-nl142aev4x
SHA256 ddaaf37f18b153df7261df2c24c1e7c748c309c5acaef1db5ab8f64461c561c3
MD5 b6576106659f48f19b286b34a9029537
SHA1 073caefd0d312ddbfd1d31eb7a5a0e16f07c66ef
SHA512 072e7a8fe10e151c015b180042453627e38c460105d5a4886c757fe3389b01fb41750037714bf35f5cd9e1b901099ae6b168b1defbbf62aa91ea67d91045cfbd
SSDEEP 12288:si4g+yU+0pAiv+Wd4Vs36WBMZ8CZ02Y5/FcZzxUlvjosTdcG93Dn:si4gXn0pD+WdWSCZPZtS9plvjRhFJ
TLSH
T10FC4F1203142C033E66719344BE9C76566BE3DA54726B8CF3BC42BA95EB02D2E779347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3124	FFC7.tmp
4544	2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFC7.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3124	FFC7.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1528 wrote to memory of 3124	1528	2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe	89
PID 3124 wrote to memory of 4544	3124	FFC7.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1528
- C:\Users\Admin\AppData\Local\Temp\FFC7.tmp
  "C:\Users\Admin\AppData\Local\Temp\FFC7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe E27F500D03FA37355DAB2EBCCA272B086463DCBA915B8D56E73A49CFBBA3AC6A6F8E03E6BB6FF43F14F371DC4F6D6F90A2A3AC8A828A7E4ADCFBF32D68BD6803
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3124
- - C:\Users\Admin\AppData\Local\Temp\2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:4544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-15_b6576106659f48f19b286b34a9029537_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

FFC7.tmp

Path C:\Users\Admin\AppData\Local\Temp\FFC7.tmp
Size 535KB
SHA256 fe6369458c0470db37042da067e5b3ab5291a6a17c7f7b260cbfefae6ce157b3
MD5 72c82281288d7c0806df1348c87e9120
SHA1 3477eccaa8ff990d14802decf5410c0bb0976954
SHA512 6149d9501fdaa6b7185651ba5c810327a11c67c85f8fde6594e9c5237de10162e8e4c3ab9ef5bafadbd38dc87245ef99b68700bc0b0545c80dbceb0bda9db05f
SSDEEP 12288:si4g+yU+0pAiv+r3vlxh1ZChEf3sa5AYWJxUlvjosTdcG93Dn:si4gXn0pD+rlxVF3sa5UglvjRhFJ
TLSH
T125C401313192C037D2A704354BFADBA9667A79B50B2668CF37C46B692EB03D2D634347
MD5 SHA1 SHA512 SSDEEP TLSH