2f43e61cbe2eefef4c3139511a13566599c52690bc8123f971c2a32507f98ff9

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_3ac79feb1853c056b96f1f7050c76d6e_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260720-qhta5adv9t
SHA256 2f43e61cbe2eefef4c3139511a13566599c52690bc8123f971c2a32507f98ff9
MD5 3ac79feb1853c056b96f1f7050c76d6e
SHA1 0d37db5434234d98d5a9918546d723555a7b2f6c
SHA512 d0db3cc7bda81ace2515661f037a085ff011ef431b0bad29c4b4a0bad96a6ed762b7f51eb7bcd742e4147888fdf061c5c971cfd68ef13c5f54e37f7f3a8af7ed
SSDEEP 12288:gZLolhNVyEX+YBJDl8aaXX0ucTp2c8k4YHbTqHI:gZqhOEOYpP0XRcd2c94Y7/
TLSH
T19E94CF247281C036D19201314BE6EB76253E7DB15B61A4CBB3D83B7E1E753D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
984	3F41.tmp

Executes dropped EXE 1 IoCs

pid	Process
984	3F41.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_3ac79feb1853c056b96f1f7050c76d6e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F41.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
984	3F41.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 984	3672	2026-07-20_3ac79feb1853c056b96f1f7050c76d6e_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_3ac79feb1853c056b96f1f7050c76d6e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_3ac79feb1853c056b96f1f7050c76d6e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\3F41.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F41.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-20_3ac79feb1853c056b96f1f7050c76d6e_elex_mafia_stealc_tofsee.exe 7A6C230F9802078924561EE64D20C6276FFED917707F0A22F18779484739668155490C730611ED6BF13D85C4E27FCC931CED8B87F49E848310219D96189CF64B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3F41.tmp

Path C:\Users\Admin\AppData\Local\Temp\3F41.tmp
Size 411KB
SHA256 4a93f6c14be92d2773543dcef256f370a1237c1cbc66ac16a5f1eea3599f91f7
MD5 5d79952af29401b548437fc4f05d9513
SHA1 afaf2fa728e4d47f7ceec1cd15881d742b8f3856
SHA512 8048b4d3a88af88cc40cc494e9ca92dcadc299a44c84519d9da74b8feb671f281fffbc6dac5d0070b27a41da4126bae157ed4eeb58e1e76fad7ddab85599a5a6
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFAcJIucQWp5ZPZuvJXJJ1dAf/qHI:gZLolhNVyEvfHTTZKXJuf/qHI
TLSH
T1E194D024B681C036D19201314BF6D776293A7DB15B6164CBB3A83B7E1F743D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads