266dcc1cb1f86ca1f4f9948209f7f48517f70964c6024c63273cb72f03a791c5

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_a0a9aa1919d102b53b745fcabf6b1a92_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260723-sh8rxseq5y
SHA256 266dcc1cb1f86ca1f4f9948209f7f48517f70964c6024c63273cb72f03a791c5
MD5 a0a9aa1919d102b53b745fcabf6b1a92
SHA1 e86cf156957e26cc6ba9c65def7ea6df5e67e437
SHA512 b06ba6784a6b3c38f2b91234d8485144f890335982a3000b89f80d54d24b1c00a46a1d61cb7162e27ed08f107104c7bfcb45486347c019bc7fabfd16ed352779
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZncwijHNPUWLMjClOMFkv0/Yn1DlRmDj8YQbP:U6PCrIc9kph5Kwij7LMyOU/0mD4Yu
TLSH
T17394E0343181C03AE19305354AEACB66693E7E658B36A8C73BD06B6E1E743D1E739347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4656	AE57.tmp

Executes dropped EXE 1 IoCs

pid	Process
4656	AE57.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_a0a9aa1919d102b53b745fcabf6b1a92_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AE57.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4656	AE57.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 600 wrote to memory of 4656	600	2026-07-23_a0a9aa1919d102b53b745fcabf6b1a92_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_a0a9aa1919d102b53b745fcabf6b1a92_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_a0a9aa1919d102b53b745fcabf6b1a92_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:600
- C:\Users\Admin\AppData\Local\Temp\AE57.tmp
  "C:\Users\Admin\AppData\Local\Temp\AE57.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-23_a0a9aa1919d102b53b745fcabf6b1a92_elex_mafia_stealc_tofsee.exe 04C07B4158FF08194733F8BCB9333F66E39DD952E47C883E01A03E2D44520F0AB19F95259E4892D0B317BFBD8F99A397D71577E29E02F03E2B7D5DAC721F41BF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AE57.tmp

Path C:\Users\Admin\AppData\Local\Temp\AE57.tmp
Size 412KB
SHA256 2dc1be78c0b344204701dd95866eb4f093605f2158623fa8855017ceff2e4579
MD5 04bf9a0a5a0abe76ca8e112ff15e7db8
SHA1 b7d052a058a2ae5590dd870d775c5e7398f2ca9a
SHA512 673057a4ab2e2e894424d98d4a3d4a981b373bdeae4e5b564be92a40eff8ef7ebbf293160a57eb3c22b02cc1b641137a9ce323ed5e8912999a206919e8888b11
SSDEEP 12288:U6PCrIc9kph5D7LRTvmYmipd0FNsMQsSO:U6QIcOh5D7LRTuYm7OMQ
TLSH
T1D994D0203584C076E1D305358AEADB76197E7E764B21A8D77BD46BAD2E702C1EB39303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads