Analysis
- max time kernel
148s - max time network
146s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
27/07/2026, 06:48
General
- Target 2026-07-27_53c7040615510ba51dbeffa995adcfd5_elex_mafia_stealc_tofsee.exe
- Size 467KB
- Sample260727-hkt2faap2x
- SHA256 575846881d06cc3844daad9bb60c898d3a58c737fb5500a9c4cc0545dc51ed33
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-07-27_53c7040615510ba51dbeffa995adcfd5_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-07-27_53c7040615510ba51dbeffa995adcfd5_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7B7.tmp"C:\Users\Admin\AppData\Local\Temp\7B7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_53c7040615510ba51dbeffa995adcfd5_elex_mafia_stealc_tofsee.exe CE7B541F5780DDD89C04EEA5FB60CEEA64AF45484AAE3817EB3BCB2DA61F83776B6849D0980EBD9E34B898BFF979C3D6C6697687B7E21D7CE54AEEAA82CBDA042⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2026-07-27_53c7040615510ba51dbeffa995adcfd5_elex_mafia_stealc_tofsee.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-07-27_53c7040615510ba51dbeffa995adcfd5_elex_mafia_stealc_tofsee.doc
7B7.tmp
iso690.xsl
CUSTOM.DIC
ExcludeDictionaryEN0409.lex
memory/4100-20-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-17-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-19-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-22-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-21-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-25-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-24-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-23-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-26-0x00007FFE9A510000-0x00007FFE9A520000-memory.dmp
memory/4100-16-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-27-0x00007FFE9A510000-0x00007FFE9A520000-memory.dmp
memory/4100-18-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-15-0x00007FFEDCCBF000-0x00007FFEDCCC0000-memory.dmp
memory/4100-46-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-48-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-47-0x00007FFEDCCBF000-0x00007FFEDCCC0000-memory.dmp
memory/4100-49-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp
memory/4100-14-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-474-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-475-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-477-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-476-0x00007FFE9CCA0000-0x00007FFE9CCB0000-memory.dmp
memory/4100-478-0x00007FFEDCB60000-0x00007FFEDCDC3000-memory.dmp