b1874433325b8e61c9d1270c5750403ed0d9f8669ff76a453a1c4bb7bf1edb14

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 12:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260727-pd2w2aag52
SHA256 b1874433325b8e61c9d1270c5750403ed0d9f8669ff76a453a1c4bb7bf1edb14
MD5 5c717530b8658dba1b763134ad79c3df
SHA1 8bdef55b8abf84a2a06d23ef2b983d2f03e7c2bc
SHA512 1d1b9d4e5405cdc3ea7456db20170a00be2c98e86c6de24390b8aa31d7b72c9111bf0f46589321f8a83a96dbfe4a9fe6d63822ab76fe150d9d4d351a91b645df
SSDEEP 12288:gZLolhNVyElYIRwzDDdclUZLQ9YBHoDkSqHg:gZqhOEuRzDDylUW97/
TLSH
T1DD94DF2476C1C032D19301354BBAD772253A7DB15B62A4CBB7E8377E1EB12D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4368	E9A0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4368	E9A0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E9A0.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4368	E9A0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 4368	4192	2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Local\Temp\E9A0.tmp
  "C:\Users\Admin\AppData\Local\Temp\E9A0.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-27_5c717530b8658dba1b763134ad79c3df_elex_mafia_stealc_tofsee.exe 0ACA694FA942B61780586A9E12114BD3ADD30995BFE47EB0852F5DD55B6417E5B40CC0F4D6DC261D85A9FDBBB9E00583039635571F1AB689B4F4C8A4C3E61A14
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E9A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9A0.tmp
Size 413KB
SHA256 7dd295d21e82ef35eeff09089d5dceeb2b73daa567bcb1e5bcdd693e25dc76cf
MD5 6ef3a7c188fd460defd5cfe2cbda92ef
SHA1 2732c124fd0747a487a9c900c01f5525c2495963
SHA512 ae68e925420c388813935eefadfca9c041ae68d43283919a39a2613663258e160559064c9a3667e83a5f5c37cb4c1a553e34f4cc88248402b39ccf7016df69cb
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFUbdCnpuDDtQDs1Uq3fDOqbzs1GoqHg:gZLolhNVyEXbd0MHyoUqPDa/qHg
TLSH
T1FE94DF29B2C1C036D19201318AF6D776553A7DB15B6268CBB398377E1F703E1A63A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads