89deae9b7ff03b354b458e9cc5fa7ab40ec7b8b9ac44b03017ec14d32ef51a68

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 08:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_e5b6327d6321cacf07179a3364d8f667_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260724-kp8rhavybx
SHA256 89deae9b7ff03b354b458e9cc5fa7ab40ec7b8b9ac44b03017ec14d32ef51a68
MD5 e5b6327d6321cacf07179a3364d8f667
SHA1 c8c9956786723f00c93b57fcc7321f0011e105e5
SHA512 eed770d116556ad71216bc6f2c2261494dd25e04dded47a2b2b7c7891351e9c7bbc74ffbf39d4fdf33d039e566e19c80e488ca301cd02d6d2079ec7c067c7d91
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFiGBRNva54HQr2dAuab4suSTyWqHg:gZLolhNVyECMx2dRszrqHg
TLSH
T16394DF28B281C036D19301318AB6D776593A7DB15B7164DBB3D83B7E1E753D0AA3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1168	3B3A.tmp

Executes dropped EXE 1 IoCs

pid	Process
1168	3B3A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B3A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_e5b6327d6321cacf07179a3364d8f667_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1168	3B3A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 1168	3600	2026-07-24_e5b6327d6321cacf07179a3364d8f667_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-24_e5b6327d6321cacf07179a3364d8f667_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_e5b6327d6321cacf07179a3364d8f667_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\3B3A.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B3A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-24_e5b6327d6321cacf07179a3364d8f667_elex_mafia_stealc_tofsee.exe C5DB799E7DB643E5B98FF3E6618C8E8D5C823B3F882002A7E96A683C0B3CE9B16BED415E960435001B86FF60B0AE029AA6461DC781DE896FC490F8426E111F05
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3B3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B3A.tmp
Size 413KB
SHA256 99170f3f77774cf7f063ea9f2e4b298243cbfa49774949f15c5ffe516f6cbe9e
MD5 f9c7823e1f79ce4d1bc8eb7916652a71
SHA1 1ad768f37517fffd31ad9a9a744e72e38424e66b
SHA512 dbda4af1521ab07a316c474ebe4574903b58f6e4a9b64c7f9dcb1866cb703a7d8a40727426140622faf3fb4724f84e4c2fb7688f4a40cfc11464458a1fc42d62
SSDEEP 12288:gZLolhNVyER6NKkE7hLUoYtdf+CkeDqHg:gZqhOER6N2UtdGCkI
TLSH
T10094CF2472C1C036D19301318BAAD776153A7DA15B6264CBB3D83B7E1FB53E1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads