6d4085e2413196817a0f1b5d2ca34de442226b74a7c769bc30f70e57f27df026

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 20:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_6b2c536645c6dfbd42781fc333b88fb6_elex_mafia_stealc_tofsee.exe
Size 526KB
Sample260724-zqwkwsshph
SHA256 6d4085e2413196817a0f1b5d2ca34de442226b74a7c769bc30f70e57f27df026
MD5 6b2c536645c6dfbd42781fc333b88fb6
SHA1 6daf35dd6a903da7aebae69a0b3793c7cb76c7e0
SHA512 512cb924cc9895bc83e813f71d1aa7b5cac0606fa90d6ec89c713144b914ef11de931d578e704b1645117ace70e85e07e4843c68ae1334a888f33f1c494c4cb7
SSDEEP 6144:zooTAQjKG3wDGAeIc9kphIoDZnyfBs/huAvHFN5xA8aWezzJYmjemS/p5hxoOilQ:z6PCrIc9kph5wK/hfA89loY/p57oFHwz
TLSH
T177B4AE385585D2B2D2A383389CE9E68E4C34F1115779B0E7A3DC07AD49BDAD09F3960B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3124	4378.tmp

Executes dropped EXE 1 IoCs

pid	Process
3124	4378.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_6b2c536645c6dfbd42781fc333b88fb6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4378.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3124	4378.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 3124	5732	2026-07-24_6b2c536645c6dfbd42781fc333b88fb6_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-24_6b2c536645c6dfbd42781fc333b88fb6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_6b2c536645c6dfbd42781fc333b88fb6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\4378.tmp
  "C:\Users\Admin\AppData\Local\Temp\4378.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-24_6b2c536645c6dfbd42781fc333b88fb6_elex_mafia_stealc_tofsee.exe D033B4446ADEA4F0B29C880335407FAE9473E712ED0E0696417E80D7AEC573B7373363DC02820CF8D3D8A4F3B189176F4E36F5A29DC8FB3EADFDBA8A22BB2913
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4378.tmp

Path C:\Users\Admin\AppData\Local\Temp\4378.tmp
Size 526KB
SHA256 1252b13f6e8b0e07493fbbbd3cfde829fd2d951b8fc1993c84a9d0fc3b65bc43
MD5 4eabf66db23005290b0ece9076d161c8
SHA1 0e6bf29180ecb83bc11d8e712e0f5784cc20d500
SHA512 58334f0d6a9cc92aac53bda5a5959757aa55177e4fb4df03ec505ddbf5eb3b9af9387233b874c50cf508f902a88eed7695d2110913e9ab4af0201015cee55639
SSDEEP 6144:zooTAQjKG3wDGAeIc9kphIoDZn3yk7Ak+44pwCUovWp1nktdrVB7nvdKRhO+z8by:z6PCrIc9kph5Zz7AX9wC+kxdlgz8Laz
TLSH
T116B4AE381185D2B6E3A383359CEDE69E4834F101577A70E7A3DC07AD99BDAD09E38607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads