cc1cd762ec25ccda40e11c90eb1abeaa7cf84a819599935f14cd68fe3a19d3ff

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_6e3d8925c143ad38cf37549be5f42937_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260720-rtzsqac16n
SHA256 cc1cd762ec25ccda40e11c90eb1abeaa7cf84a819599935f14cd68fe3a19d3ff
MD5 6e3d8925c143ad38cf37549be5f42937
SHA1 977c02983067a19bff93e15644ec90a92c6f01be
SHA512 13d6530556bff0e62cac2699c6a9862ec8e8f23473fb750265b1589381c1f912fffef83d8b5389942296d7fffe24d386b32cb525c43e5af4727d25bee0a4f6f3
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn2ccgQRyWzGWclXrOPow2UF7kAjYUPKpKjWhVT6:U6PCrIc9kph5Y7RAl+928r1PKpKqAdD
TLSH
T1FE94D0243485C036E1E306318EEADB67193E3E795B2268C767D42B6E6E702D1EB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3696	6A97.tmp

Executes dropped EXE 1 IoCs

pid	Process
3696	6A97.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_6e3d8925c143ad38cf37549be5f42937_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A97.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3696	6A97.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 3696	4148	2026-07-20_6e3d8925c143ad38cf37549be5f42937_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_6e3d8925c143ad38cf37549be5f42937_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_6e3d8925c143ad38cf37549be5f42937_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\6A97.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A97.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-20_6e3d8925c143ad38cf37549be5f42937_elex_mafia_stealc_tofsee.exe 0D55331C199A857A253ED20A77F3FC3D3AC138362B7AD5BD2E1F6748C79E01F2D225B1A7DCF7975311E200366A6B29D4A0CA722A68AB23764E210BCFB35A2566
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3696

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6A97.tmp

Path C:\Users\Admin\AppData\Local\Temp\6A97.tmp
Size 412KB
SHA256 476153033aa06a7c9439dc3b046eb114db05dae144b8227477e00974b2749d46
MD5 d914c2746c92ba43a53cee71f3094527
SHA1 d48d303a2e178e585485ee58d689333ac43a3c27
SHA512 3d46b714dbac9e5ab7cb95c19494d7e6ad9a78afe7bbf6d2f5dad3321d874936b6ff9a2192a0037e89e792d69ef98fb15d9ea0fbebb37fa3b68ea843d43292b1
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnjjS65gqtOON1pw4ljqHbINthdkPslP:U6PCrIc9kph59C7YPljImePsN
TLSH
T1DB94D0343584C037E5A305348EEACB66692E7DA1472668C77BD46BAE2E717C1DB38343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads