966be9729bb905c8a7df96930691008f579a68251e8ae377133e0f7747ec4ec3

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 16:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_ca9009691efc084775c77adc680512aa_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260721-t5wljseq2v
SHA256 966be9729bb905c8a7df96930691008f579a68251e8ae377133e0f7747ec4ec3
MD5 ca9009691efc084775c77adc680512aa
SHA1 29b591b0a2a929314dece5a46b757fe442d628ad
SHA512 4cbfdf7cc673b00d678983210ac6196c9ba9f58616f6d1a77ba9b5d8b741c05bb984b2d614ea4d21816cbd8a8aaf527899119b1a11b184905a4cb192b7455c89
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF/RcNVmY342s7bCOgApaZfNqN2puME6QqH:gZLolhNVyEycHTrs/F9YFqMuMEFqH
TLSH
T17894DF25B2C1C036E19201354AFADB76253A7DB15B6164CBB3D83B7E1E703D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5136	112D.tmp

Executes dropped EXE 1 IoCs

pid	Process
5136	112D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_ca9009691efc084775c77adc680512aa_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	112D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5136	112D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4576 wrote to memory of 5136	4576	2026-07-21_ca9009691efc084775c77adc680512aa_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_ca9009691efc084775c77adc680512aa_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_ca9009691efc084775c77adc680512aa_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4576
- C:\Users\Admin\AppData\Local\Temp\112D.tmp
  "C:\Users\Admin\AppData\Local\Temp\112D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-21_ca9009691efc084775c77adc680512aa_elex_mafia_stealc_tofsee.exe 815F46E56597B485E907EA9CF897FE8DA113C68E38B28E6EF2A2CD3A133C463A79AC9AE2EBB109E104A937D3B437651897CD94DD255C381FB4D53913DECA390A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

112D.tmp

Path C:\Users\Admin\AppData\Local\Temp\112D.tmp
Size 411KB
SHA256 6d98c4054efc67acbad206910040278e236e016c309b11016194e8f5e994e7e5
MD5 11aaee5de86768d6b8ed6f6ff6640846
SHA1 ec706aea488493c24cbfefc3dd72bda6f9e83186
SHA512 6df5f9f329b2b230493c34cfb820f0e61a47e93813c64a559af1303c5e9079dade4bfb21bdad0677ef4a8c2878e896ff7dc5419efd1c2b509a609276435bfca3
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFyHvOqvU8VxAzA0b79E5xMlHrW99rqH:gZLolhNVyELHlU8VxZ0VE5xMlHSnqH
TLSH
T19E94DF24B2C1C036E19301354BB6E776653A7DB15B6164CBB3D8376E2E743E0A63A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads