4166dec3142f0d36a73fa5698eb3e14f73b2d3802d1db46eb651331aee06ee05

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260721-tbfcgaca74
SHA256 4166dec3142f0d36a73fa5698eb3e14f73b2d3802d1db46eb651331aee06ee05
MD5 01c76155e9e56aa6116ee4664b17e6b2
SHA1 12bd0b540647a0ecdd34d21d660191f3c62098ea
SHA512 874acf9f46a5c6cdc4999d34fab2b9d176a310478097920630a799dba1622f0773b9e657dc0f4c511f614cfbde171a25f8d87fef640f9d8dce8a2244bcc842e0
SSDEEP 12288:si4g+yU+0pAiv+tJUQJMOUpGr8XSCLgpc10OSxzxUlvjosTdcG93Dn:si4gXn0pD+tZMOUY8XSCLgpW0DglvjRZ
TLSH
T139C4F1213582C033E5A718344BE9CB56657E78B24766B8CB3BD42B692EB53E2D334347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3692	58D4.tmp
1412	2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	58D4.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3692	58D4.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5908 wrote to memory of 3692	5908	2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe	88
PID 3692 wrote to memory of 1412	3692	58D4.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5908
- C:\Users\Admin\AppData\Local\Temp\58D4.tmp
  "C:\Users\Admin\AppData\Local\Temp\58D4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe B9EFA777C80EEE60C1072CFC9B928B25A3BD4D658700B5221A629C7CE069410444E3F5D26C8C934D301BC0E1816DE7EF9667D5AC39E74A509A6CB514CDF0C200
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3692
- - C:\Users\Admin\AppData\Local\Temp\2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:1412

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-21_01c76155e9e56aa6116ee4664b17e6b2_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

58D4.tmp

Path C:\Users\Admin\AppData\Local\Temp\58D4.tmp
Size 535KB
SHA256 00989c7390da04c31f4d799531b82078750141a0b72c8ecdb10759c150030558
MD5 77d0f670d95987b22a8137945eb30e67
SHA1 1ae0d0e09d4b81cd0775c9fca66e517730f718be
SHA512 4a087d8d6ce4d24698c9d2170c6fc43f16bf19d2f40efaf66cf98515a3f2e06e744136a0ed64f7252ff8591248d28e22cf14076cf16e2f6d3cddda69bf783a4d
SSDEEP 12288:si4g+yU+0pAiv+7AWFbGliv8nthitpIMTW4PxUlvjosTdcG93Dn:si4gXn0pD+7ZqikHGIqGlvjRhFJ
TLSH
T1EDC4F1203582C037D2A705315BE8CB65A67A7DB61726A8CF3BC42B6D6EB03D1D63435B
MD5 SHA1 SHA512 SSDEEP TLSH