78a0e888ba50a7c9fea24c7bb4895f9841270f8fe7fcde50f818116c6daa87a8

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 23:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_1f381e244a73ce6bd98b7dd0749b5eef_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260728-3fdtwace53
SHA256 78a0e888ba50a7c9fea24c7bb4895f9841270f8fe7fcde50f818116c6daa87a8
MD5 1f381e244a73ce6bd98b7dd0749b5eef
SHA1 039e79afe837a531db9c7c242ab017035e7d28b8
SHA512 6d3b90bd9ca35cfe6de0cfe55090c9f13b8484c6920fe17c3d21e690166568f669863e03c5d31de4f5aa8bc560a92cc226c99bba151a72cd8ed21c5a8f5f072a
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hH8x9phuRoqSnqzDZww15NDYmqheb3+So1Z:Zm48gODxbzWuRVu8mMYmqG321Z
TLSH
T12E84C0247581C036E19B01314BFADB62593B3DB29B2468C77BE47B6D5EB03D1A73920B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3548	3FCE.tmp

Executes dropped EXE 1 IoCs

pid	Process
3548	3FCE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_1f381e244a73ce6bd98b7dd0749b5eef_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3FCE.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3548	3FCE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4120 wrote to memory of 3548	4120	2026-07-28_1f381e244a73ce6bd98b7dd0749b5eef_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_1f381e244a73ce6bd98b7dd0749b5eef_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_1f381e244a73ce6bd98b7dd0749b5eef_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4120
- C:\Users\Admin\AppData\Local\Temp\3FCE.tmp
  "C:\Users\Admin\AppData\Local\Temp\3FCE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-28_1f381e244a73ce6bd98b7dd0749b5eef_elex_mafia_stealc_tofsee.exe 2EE90681526F28BC16C966A50C3DCD082A85255FF421F8F88E5FB8A4D3CBF6CA3570403D74E17153CF7C4304532ECAFB6B15DAC7677330E66A188B845EA0540F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3FCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\3FCE.tmp
Size 384KB
SHA256 3ed60334d58a9f8ced6435925f3748bf4a631b343b206089213bc579387143aa
MD5 aabb0cde9332d70afe36f38f3e39ab4f
SHA1 bd6d573495cc012938f386ddb2864e9c38d82a15
SHA512 8db1254452b67917f804a9fc832a3475df8a0be6b0b6bca963170a98b80ab6992afbc08d05e6af45e393a6923ea8871627273a3112ddf41afc259e6f1fceafb4
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHMMD+gfk0eEMJ0OeUQ1vuS+zqWX/OZ:Zm48gODxbzK0fNeQOJQISuqWX2Z
TLSH
T1A084CF347581C036E19601314BFAEB625A3A3C725B2168D77BA47A7D9F703D1EB3824B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads