0942d4638458294d22c9603ba77357849a8fdf8d9f3a180b226207c9f3a31064

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_d95918698745655cf703e2df0685fa19_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260718-b945dacv4j
SHA256 0942d4638458294d22c9603ba77357849a8fdf8d9f3a180b226207c9f3a31064
MD5 d95918698745655cf703e2df0685fa19
SHA1 f45d4007d487cb6e4edafc485eb9130b2bd81a2a
SHA512 220969d998128cd4789de25dae18e7a95390ca596fdd17de2c2fd2e8a69ebfa929a2ec5cee04999e268e0f2f944709fb2c1c3916a254887c17b0dd8405d56bff
SSDEEP 12288:gZLolhNVyEEWSsDWF4KdDjtg3+E16fSZqHI:gZqhOEEN4K90F16c
TLSH
T1A794CF297281C036D19204314BFAD776193A7DB15B6264CBB3983B7E2FB13D1A67930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5340	1D81.tmp

Executes dropped EXE 1 IoCs

pid	Process
5340	1D81.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_d95918698745655cf703e2df0685fa19_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D81.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5340	1D81.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4372 wrote to memory of 5340	4372	2026-07-17_d95918698745655cf703e2df0685fa19_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_d95918698745655cf703e2df0685fa19_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_d95918698745655cf703e2df0685fa19_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4372
- C:\Users\Admin\AppData\Local\Temp\1D81.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D81.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-17_d95918698745655cf703e2df0685fa19_elex_mafia_stealc_tofsee.exe 9258D342D314835F630E03AB196EC43E8B494CD3B64DD66754273D802AA32E396C52AD00B53FE6D747E6AA5E5D333A6233AF733A14DF95D26DFBAD5D08B4745A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5340

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1D81.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D81.tmp
Size 411KB
SHA256 f770c2547def2ae37f57231dbd686948d6787516602650b7a60185ff6cf9839d
MD5 f6f4c383674093cbf479380d310b15fd
SHA1 0f26d0d5eb1c33d558d8b06a6b45ff6e0bee493f
SHA512 58a4714ff937d495bf806cc606cf398928f6e9aa732c3180154f3684d1112ff1db2202ed0be3a0a7abcf1c2736a0c135857e3067992545f46c0c517d7ecc89f0
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFJjWZgixptMccn9NVTthxXH5aqHI:gZLolhNVyE8NoELEqHI
TLSH
T1A994D028B281C036E59301318BF6DB76253A7DB15B6164CBB3D43B7D1EB42D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads