ea2b4c40ad623eab9ef8427e8537fb4932a531b929a3204fedc86470b41ef409

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 15:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_12b2c610db4c78e09e56fb30e7d2e451_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260727-tfg2vswerd
SHA256 ea2b4c40ad623eab9ef8427e8537fb4932a531b929a3204fedc86470b41ef409
MD5 12b2c610db4c78e09e56fb30e7d2e451
SHA1 69530213a89bf27f3bc941c63f09fc03d845fafd
SHA512 e7eb0152cd13063f12c52c43a4e29c0deae8b938d46719fbab6c1eff9d9a869bf23375a0d7546e048c9786a4b9eb13daa51ee042483633bd85760710804b74f4
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFkLzYPaKQ8y68InP6iEkZnIqHI:gZLolhNVyEDnfKQ686P64nIqHI
TLSH
T16C94DF2876C1C036D19301304BEAD775263A7DA15B6264CBB7D83B7E1E713D1A63A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3384	3F32.tmp

Executes dropped EXE 1 IoCs

pid	Process
3384	3F32.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_12b2c610db4c78e09e56fb30e7d2e451_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3F32.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3384	3F32.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 3384	6080	2026-07-27_12b2c610db4c78e09e56fb30e7d2e451_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_12b2c610db4c78e09e56fb30e7d2e451_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_12b2c610db4c78e09e56fb30e7d2e451_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Users\Admin\AppData\Local\Temp\3F32.tmp
  "C:\Users\Admin\AppData\Local\Temp\3F32.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-27_12b2c610db4c78e09e56fb30e7d2e451_elex_mafia_stealc_tofsee.exe E1D8FE5F4FD9B0197535CD94F2BC523C07DFB30211BF7568AF8F9A5AC840E4C857DF9541619355D23DF99593CF49F9E09044F0C7B31DADDAEDFEF93394FF6CD5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3F32.tmp

Path C:\Users\Admin\AppData\Local\Temp\3F32.tmp
Size 411KB
SHA256 664310f7224170f63248c4e8e2cfed08ff7ce26039e4e28b9e0fb7231b0b7218
MD5 27365457d34a14eb8b7b9ab8ad53b0cc
SHA1 ed4e0d73ba369bc9d53e0c8a96b91f19507e30ed
SHA512 8ca58ade7e462209cf8d7486e7ba9fac38dafd19ec9320484f5c8b752a4371a342572dd717e9f42009cad49a37eeb8dbdf1104eb413dc6646bc5679bb8ab0039
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFaIqwWKv9PwJtfb/66CAtgf/g+dL6nqHI:gZLolhNVyEnOWu9PwJl/1+F6nqHI
TLSH
T13094CF2472C1C036E19201318BF6E776553ABDB15B6168CB73E8376D1E743D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads