2eea5859b62fed9e03bc84f0761ed0185b71424c53196e09cdbb8b2c0313e84c

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_a59dae6292c576af2db58f4b343570cd_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260729-vtts9ack4t
SHA256 2eea5859b62fed9e03bc84f0761ed0185b71424c53196e09cdbb8b2c0313e84c
MD5 a59dae6292c576af2db58f4b343570cd
SHA1 be234edd14a945b392df7c6ac0da9259eac2cd82
SHA512 ab4c86991f7a0abbfddfa8e71c2acfb4c45cf0a443f1622577c492a17652804fc1502dd6ed3211d20847eead7ba7b150ca0078e515d898bc3f33fe054681352e
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFhxaMeBXhpW9WR54g6pHg9qHI:gZLolhNVyEXVjpeWR54g6pH4qHI
TLSH
T16194DF28A2C2C036D19301354AFAD736653A7DB55B2164CBB3983B7E2F743D1A67930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5352	9178.tmp

Executes dropped EXE 1 IoCs

pid	Process
5352	9178.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_a59dae6292c576af2db58f4b343570cd_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9178.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5352	9178.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5352	5856	2026-07-29_a59dae6292c576af2db58f4b343570cd_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-29_a59dae6292c576af2db58f4b343570cd_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_a59dae6292c576af2db58f4b343570cd_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Users\Admin\AppData\Local\Temp\9178.tmp
  "C:\Users\Admin\AppData\Local\Temp\9178.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-29_a59dae6292c576af2db58f4b343570cd_elex_mafia_stealc_tofsee.exe 02D6533E8EB11811C1AFC4CA9137B55E77438BC89CD85A6E10377C2EFB8D09E9F10E38F860EFBEE34921DD696C62D44D5CF319428EF1D82207E0EF302230EEFA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9178.tmp

Path C:\Users\Admin\AppData\Local\Temp\9178.tmp
Size 411KB
SHA256 5e30353c3fd0659e5e722b8527343f5915ca7b7cc50efff5b42593ed7a86a520
MD5 f8c123c2be2c70b2a02288f658ef5b3b
SHA1 69828caecf163f772c40a27951928acc36847fb0
SHA512 e56ac4f6a4cc9b2cd34c1cf721ba8d473d42439fbbae7daf548b5cf390f34530ca9cd51bee2a4d6e5a84a3a6bfb1902b63cdd8f8628c4f242e6ac63fbdf47e3b
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFuQeE/eCtm6V5JXAOM69gf5ssoDH8BqHI:gZLolhNVyEg//NY6Vt9gf5svcBqHI
TLSH
T1B194D028B6C1C036E19300314BE6D776247A7DA15B6164CBB3D83B7E1EB53D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads