16c94cb5682b9438e3109b367d323ee414df278b8d57bf778f9b24d2cae423dc

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260720-ryfweadt2n
SHA256 16c94cb5682b9438e3109b367d323ee414df278b8d57bf778f9b24d2cae423dc
MD5 50b97ef346703371690b137506175126
SHA1 cbd15ed11e3f645f3c1b379d6caa758a2e9e4cbf
SHA512 b02c62393fc6437c7ca3d742355aac93eae92b246b1045328470c994982cf0c17091c2d133d665e207ec0117fab5a907deb05e1620a5cefdbc6f5c331035c44d
SSDEEP 12288:si4g+yU+0pAiv+fUnKtoAynCdTLaT7FxUlvjosTdcG93D:si4gXn0pD+ffU+m7UlvjRhF
TLSH
T135C4F1203552C037E66715354BEACBA66A7E78B5872178CF37C42B6E6EA03D2D234347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2772	5356.tmp
4580	2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5356.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2772	5356.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 2772	1692	2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe	89
PID 2772 wrote to memory of 4580	2772	5356.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Users\Admin\AppData\Local\Temp\5356.tmp
  "C:\Users\Admin\AppData\Local\Temp\5356.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe 55BD315A6E944DFFA865ED4540418E106E17FE63486C98846E5938ECCA96F364939F52DCD46D0A908458A497B0B9890FABF938D96F84B72151CA6AE26AC97AED
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2772
- - C:\Users\Admin\AppData\Local\Temp\2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:4580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-20_50b97ef346703371690b137506175126_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

5356.tmp

Path C:\Users\Admin\AppData\Local\Temp\5356.tmp
Size 535KB
SHA256 87e835d7a275a062a89ba199123e94022f23d7713447a1756137c82f74c84fb0
MD5 b01a4339d59f88c8776af7412d5e1dc7
SHA1 9d9fdbb2d73814ca00eb2a48df6a890faa2d1fe4
SHA512 6d2f55099ada7d5486c8331e6e5b6f5501e1c4ad90838832e08565d3b5bd6f801f1bebaacd06dc12406796af7a1c6e37f9a51365f950bb6d42e8c087a6c523d5
SSDEEP 12288:si4g+yU+0pAiv+T9MxIqw4IJM/PrxYiVf8ui4sbxUlvjosTdcG93D:si4gXn0pD+gfw4xbxdziYlvjRhF
TLSH
T10AC401303492C03BD2A615354BE9CB65667A39754B22A8CF3BC42FAE6E703D2D635347
MD5 SHA1 SHA512 SSDEEP TLSH