47e1f2d4f8da8ddfe2fa2dedb16c7dbcdec38f3a6bff52796edf9532ce32de28

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_a685b1ff0909c965e3ba85839fdf5e38_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260718-hkfttaex2y
SHA256 47e1f2d4f8da8ddfe2fa2dedb16c7dbcdec38f3a6bff52796edf9532ce32de28
MD5 a685b1ff0909c965e3ba85839fdf5e38
SHA1 e1bfc0df304546160234a407f600b0341e7720bd
SHA512 43b2cb11c2d4c8bdde4c1081316185ae6bde4d28416de902fcaad0e93fd1e399e96c45d21a320db6642e234a605cff73f87280736808379c809730b878f537a5
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHdAzFZ/guUFt+ehhgHUOU6r+P7N4thZ:Zm48gODxbzEzX/glWeHg0Fv7WZ
TLSH
T1E484CF347681C036D19B01315BF6DB621A3A3DB24B2568D77BE47B6E9EB03D1A73420B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4248	73BF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4248	73BF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_a685b1ff0909c965e3ba85839fdf5e38_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73BF.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4248	73BF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5052 wrote to memory of 4248	5052	2026-07-18_a685b1ff0909c965e3ba85839fdf5e38_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_a685b1ff0909c965e3ba85839fdf5e38_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_a685b1ff0909c965e3ba85839fdf5e38_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5052
- C:\Users\Admin\AppData\Local\Temp\73BF.tmp
  "C:\Users\Admin\AppData\Local\Temp\73BF.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-18_a685b1ff0909c965e3ba85839fdf5e38_elex_mafia_stealc_tofsee.exe 0B35B022AB844D6BA69313EC15E798243AD2D830C1995D10336711A05AFBC2F38F4A9C5DC8BF8920182E8B9D65485686B89E3A5546DAB502CFC42E69AC3CF2D2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

73BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\73BF.tmp
Size 384KB
SHA256 0b1d2ad136dbb5756e1af7f9ca1a3965db11c335c10feb9eb4e2827e84c1dfc7
MD5 649ea0ed55d19388a55db8c59b0d72a7
SHA1 f989405eb9ba0112b5c842b4d0e65bdb01c989a9
SHA512 c47acd7b866b6fcdf025134feaaf172afdc83e70b544c2256e353b7a820cbc41603156f80fbe0d845e8ed2a4cf4bdc7a07992a58abea880acbe54fa2d8de216b
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHyNi5qaIrZ61iaidYOLjtmc5vaS/2Z:Zm48gODxbzyiwaIrldb5/2Z
TLSH
T19684CF347681C036E19701314AF6EB61593B7DA29B2568CB7BE07B699FB43C1A73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads