2ea69ee25b092f9e3ff840430b34033a17a563e1c1a93e359d28354ab0724fe1

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_d4408a4da6215bd93044d32746b8814a_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260720-rfmk8sew5y
SHA256 2ea69ee25b092f9e3ff840430b34033a17a563e1c1a93e359d28354ab0724fe1
MD5 d4408a4da6215bd93044d32746b8814a
SHA1 e8fa97183de1baa6c88b2264176c96a61ec18907
SHA512 5223271a4e4120ef9a48bea44ef431b94611ef951f279e615f5848b30d2940feb2ea81394790dffc34c7bdbed6f9acfb3ec58d3cfffe59bd255c86f18ab4cce1
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnkBlMrV6cknnWwQFIEAqdxvrSHE5P:U6PCrIc9kph5GbMMdWbnAqxveS
TLSH
T1B494E0343681C076E29706308AE6DB76693A3E75573169C73BD46BAE2E702C1E738347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5864	DBD4.tmp

Executes dropped EXE 1 IoCs

pid	Process
5864	DBD4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_d4408a4da6215bd93044d32746b8814a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DBD4.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5864	DBD4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5920 wrote to memory of 5864	5920	2026-07-20_d4408a4da6215bd93044d32746b8814a_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_d4408a4da6215bd93044d32746b8814a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_d4408a4da6215bd93044d32746b8814a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5920
- C:\Users\Admin\AppData\Local\Temp\DBD4.tmp
  "C:\Users\Admin\AppData\Local\Temp\DBD4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-20_d4408a4da6215bd93044d32746b8814a_elex_mafia_stealc_tofsee.exe 76295EA906DA9951AD67A56BB969B446F7D8771F86B5BF19857EA58205D78B995304917C4C872D01A45779A0EB9778D8A71ACD5CB38B9041C8469F166B44BC8B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DBD4.tmp

Path C:\Users\Admin\AppData\Local\Temp\DBD4.tmp
Size 412KB
SHA256 1c9f9776c776bc9138ca71fdb2d1282b5742243ebd23831ebbf098acf595761e
MD5 0cb2c3782484154eaaad2931262e2129
SHA1 501a249720585db0e215d8892d8716c34c811a92
SHA512 592e7a37b25fe2deefcb72c045e763aabea338d7a793c1e78b4ffaaf2fbabb6ef3963aa43d78bcdc5a6fc923cb66ec5e62ef31fbc05ea61a568e8cff2e131480
SSDEEP 12288:U6PCrIc9kph5FJoiJqPDA6rAp9oSPuOj:U6QIcOh5fULA6O
TLSH
T14394E1303581C036E19305359AEADB66293E3E755722A9C77BD42BAE6E703C1EB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads