9df9a672214e7358bd5d7abb8668ee95045597a8858aaa5907a3f20106dbdbcb

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 20:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_c1cab5f7f6e52c7263468f8e2b691a46_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260724-zb95qseq7y
SHA256 9df9a672214e7358bd5d7abb8668ee95045597a8858aaa5907a3f20106dbdbcb
MD5 c1cab5f7f6e52c7263468f8e2b691a46
SHA1 5fb7cb8867776c7b2bbd9b3bfb2fa557efcad960
SHA512 9e20b48641b42bcde69ea326771b2a60b1e92dbe27879d055e50d5809c72ba5f8ffe2f8bb3de03464c37d4d716d5531d03209b754040fc10766082a185746b5e
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHfu0Xhh+3AZmaw7sToIi5vORnINiukZS5+DkZ:Zm48gODxbzRPXzcAWsEJ4INiPZSTZ
TLSH
T1C484CF34B5808037E19701318AE6EB61193B3DB69B6468D77BE43B6D9E703D1B73424B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
824	EFAA.tmp

Executes dropped EXE 1 IoCs

pid	Process
824	EFAA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_c1cab5f7f6e52c7263468f8e2b691a46_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EFAA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
824	EFAA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4700 wrote to memory of 824	4700	2026-07-24_c1cab5f7f6e52c7263468f8e2b691a46_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-24_c1cab5f7f6e52c7263468f8e2b691a46_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_c1cab5f7f6e52c7263468f8e2b691a46_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4700
- C:\Users\Admin\AppData\Local\Temp\EFAA.tmp
  "C:\Users\Admin\AppData\Local\Temp\EFAA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-24_c1cab5f7f6e52c7263468f8e2b691a46_elex_mafia_stealc_tofsee.exe 1C5A9A6F80C4B9AF29313CC82E73EDA71E33ECCD25C348475BA7536202EB20D3AD59D684FA76E8C207C37BE01F1C34CE8EE9C26BD92B2514B4259E9EA65B77DE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EFAA.tmp

Path C:\Users\Admin\AppData\Local\Temp\EFAA.tmp
Size 384KB
SHA256 c2023f82ef8e9e091b810cbb389f36b0024fbc2e9ece3ee0a399de4842845df0
MD5 0506fe8f707a3cd6ffe054dc7112dfcf
SHA1 e99f6141dc2afee85c25801a32abad9ea168db65
SHA512 42235be296a892998c15a70d45353e0ea86e70ac35801aeb37d1fa4cb7830cc9d04d75d72fbd7d22a02d9d4f7e9da257af6ae4bba4457e2bfa6ae96347bd3be7
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHIQuALHP0/vgg7xX+WLqopNORZ:Zm48gODxbztuATPm3xTLXpNqZ
TLSH
T14D84D024B581C032E19705314AEAEB61693B3C725B2568C77BE47BBD9EB13D1A73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads