d6c1322089cdacee2f287693e72b8eebf58dcbaa754eddf65dfadce5ee5c683d

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/07/2026, 02:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_38c2ab054de5934920b1c5a539377fc5_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260716-cf6lsaet3z
SHA256 d6c1322089cdacee2f287693e72b8eebf58dcbaa754eddf65dfadce5ee5c683d
MD5 38c2ab054de5934920b1c5a539377fc5
SHA1 019d098dffb9ce5875f1fadedcc80b2d12234256
SHA512 57d7fb6079278926ffba19172754fcb7d12ddd8072507813ef71edebcda1696aa2cff6b19c4c07028b33e5e6639743402cef3057ddb3b2889f515cd26c2e31b0
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFW9qh57uScLosau2H8zOiHqHR:gZLolhNVyEAE9Losau2H8z/qHR
TLSH
T17A94CF24B2C1C036D19601354BF6DBB2553A7DA15F6164DBB3D83B6E2E703D0AA3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4260	27F1.tmp

Executes dropped EXE 1 IoCs

pid	Process
4260	27F1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_38c2ab054de5934920b1c5a539377fc5_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27F1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4260	27F1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 4260	4980	2026-07-15_38c2ab054de5934920b1c5a539377fc5_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_38c2ab054de5934920b1c5a539377fc5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_38c2ab054de5934920b1c5a539377fc5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Users\Admin\AppData\Local\Temp\27F1.tmp
  "C:\Users\Admin\AppData\Local\Temp\27F1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-15_38c2ab054de5934920b1c5a539377fc5_elex_mafia_stealc_tofsee.exe 7CD4F6A1D4CD4615FCC500FA354BC73C03EDBBE0BCE9D0DC7F217423A36957BB42F9F9517592B7EED751E6F8623A9E1776318EBAA091492BE6B49C999EBC9AC2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

27F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\27F1.tmp
Size 428KB
SHA256 a74ed7b444d634abcf50fde69c2bc229241c3e0c88ece10d139f266ecc508ef3
MD5 5d76bcb327d21a7c3d26021d21b7fe8b
SHA1 57257449733336437b5a5b8b7ac925cd32a1c745
SHA512 1573ee60ee82b652840ea9d459161b4e7990c38bab7dc4ba38f3045d129fa6e03219355fa498ba3edb60db2cc34686d164176c77fa4cb437830d4e112dc1d1da
SSDEEP 12288:gZLolhNVyEg0Jevx1nr3wxEwpdSKPUqHR:gZqhOEgOcidSKPz
TLSH
T11394CF28B2C1C036D19300314AE6D7B6193A7DB15F61A4DBB7C8376D1EB13D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads