Analysis
- max time kernel
148s - max time network
133s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
20/07/2026, 13:04
General
- Target 2026-07-20_7d3d826eafb5634b21ac16ee13b3e071_elex_mafia_stealc_tofsee.exe
- Size 448KB
- Sample260720-qa43naa15l
- SHA256 1ef4287c5c7c81b488da9a07c503439db47b98e52de56114f0657d58dc7fcfd6
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d3d826eafb5634b21ac16ee13b3e071_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-20_7d3d826eafb5634b21ac16ee13b3e071_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E4CD.tmp"C:\Users\Admin\AppData\Local\Temp\E4CD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_7d3d826eafb5634b21ac16ee13b3e071_elex_mafia_stealc_tofsee.exe 98EDBDA0598B84AF00BFD03ED26FC2F537AF3DFABCB26DD7B1C0EAE735CE8BB6BF76B3E87F19B16BE1126AA7DA2DD737E24E6868DFB699FB979B564B5BB97CF22⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
E4CD.tmp
memory/1300-0-0x0000000000690000-0x0000000000709000-memory.dmp
memory/1300-5-0x0000000000690000-0x0000000000709000-memory.dmp
memory/3836-6-0x00000000005C0000-0x0000000000639000-memory.dmp
memory/3836-8-0x00000000005C0000-0x0000000000639000-memory.dmp