845234a1294207fe8b5cd10c61e3edce6a0a1ed6f04c74746387c1e4a83cf74c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_36887063f1c9755f178c97fbaee105fb_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260719-vplbbafv7l
SHA256 845234a1294207fe8b5cd10c61e3edce6a0a1ed6f04c74746387c1e4a83cf74c
MD5 36887063f1c9755f178c97fbaee105fb
SHA1 4f01a6295634523fb1865d3789e16ef6161cca1a
SHA512 53bc32a8e9d8af1c6486c75e328dd022447e462b8d48a0be7da882520daa235e6a739b92471f755ae8fe4234b79d6ee1bef3ab2dcc80e50a1156e21a01ca11d6
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHEoM0AW+mFddn5BUIJVXWItmswEGZ:Zm48gODxbzlAWxdDHh/lGZ
TLSH
T10484DF247581C036E09701314BF6E7A16A3A3DB28B6568C77BE43BAD9F713D1A73424B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5820	4397.tmp

Executes dropped EXE 1 IoCs

pid	Process
5820	4397.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4397.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_36887063f1c9755f178c97fbaee105fb_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5820	4397.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3648 wrote to memory of 5820	3648	2026-07-19_36887063f1c9755f178c97fbaee105fb_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_36887063f1c9755f178c97fbaee105fb_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_36887063f1c9755f178c97fbaee105fb_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3648
- C:\Users\Admin\AppData\Local\Temp\4397.tmp
  "C:\Users\Admin\AppData\Local\Temp\4397.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-19_36887063f1c9755f178c97fbaee105fb_elex_mafia_stealc_tofsee.exe 6472FA84E01672610F1EFDC78B8D987F6784E0BF834C9E8D667B6D8391D36D8D03364B0FA63A018824109F6DE8032A085E90859CDF222F695269BDC94ABA01AB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4397.tmp

Path C:\Users\Admin\AppData\Local\Temp\4397.tmp
Size 384KB
SHA256 d181a2fbc9de3140cbad8e69fd9aba7bc2b100369c589538ec33d0cdb2db46c8
MD5 4679f885e2487b2e95fbbce923ea1e73
SHA1 ad00a0a2f3f76b448f4b8ed947b69b18f2b2fa32
SHA512 e9095e128bc838371502fb7ed60bcdc49650f7882341a06d3f0283306fee39782a263ccb4c0b32e30b25f0f8a6aabfa52aadec8e9f3a1e7123cff1865a482db2
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHWiKTa5TVK9u268x0TEXJuLBd9J8yKB+gZ:Zm48gODxbzuTQTVKw5ZH9JGB+gZ
TLSH
T1BE84D0247581C033E19701318EF6EB621A3A3DA25B2569D77BE47B6D9EB43C1B73420B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads