9a550d12fe02a23babebedabcb7d627581f0bd053473a0162ce6f9d33c0f8c19

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 09:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5e515c53306ee4a021a91bbadfb05156_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260720-ltmv9sdx2n
SHA256 9a550d12fe02a23babebedabcb7d627581f0bd053473a0162ce6f9d33c0f8c19
MD5 5e515c53306ee4a021a91bbadfb05156
SHA1 399573e663eade78ac2f1b8c0e993d6d3564a119
SHA512 bd37765cf10b42faaee4ed075e4a0fac2401c4ccec5233de5f8eda3094dc37b5cb0994a0a358edecd401562aabd36865e19335e35847af37fbe6c9089291d770
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFO2pUqnCvd9vW3OTw0Ot2NqH:gZLolhNVyE2pvnSq3OT5OwqH
TLSH
T11794DF287681C036D19301314AF6DB76193A7DB59B6164CBB3D83B7E2E703D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2712	8320.tmp

Executes dropped EXE 1 IoCs

pid	Process
2712	8320.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5e515c53306ee4a021a91bbadfb05156_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8320.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2712	8320.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2712	764	2026-07-20_5e515c53306ee4a021a91bbadfb05156_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5e515c53306ee4a021a91bbadfb05156_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5e515c53306ee4a021a91bbadfb05156_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\8320.tmp
  "C:\Users\Admin\AppData\Local\Temp\8320.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-20_5e515c53306ee4a021a91bbadfb05156_elex_mafia_stealc_tofsee.exe 382B3ADDD4582C6B0C971B8B45B15B49952C0CDA7F0484153CCB8651C7BCC34BD023D51DDBD682CF73206C4C6EA5337618F24AE3E6D20F65593BC5F3BA9213AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8320.tmp

Path C:\Users\Admin\AppData\Local\Temp\8320.tmp
Size 411KB
SHA256 6d33c6ee17d46c00100cbc4b45e8b3197ffc9031c542c9db0f6ca619b789e918
MD5 2d497ea114feb23f63ed8b53209b5935
SHA1 d3fd7a5baa84b4f521978860f1c88bd0ba4e4e74
SHA512 749e1322cdf32085de299f53634bdec6826d8d34764b55432457e17524cbca999eea2b7024613fab131a950c82cc457a7091acdbed114b590eba897222d3119c
SSDEEP 12288:gZLolhNVyEqKhmklxYybtB6bsjT6QCXljHSjqH:gZqhOEBplxYyWtDl
TLSH
T17E94DF24B2C1C036D19200314BE6DB76653A7DB25B6264CBB3983B7E1F743D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads