b2be2e9546dafaed28ff03dd5c8d7e532a8710fbacd79b41e28bea3e02dd7706

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/07/2026, 20:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260729-y6kynaed49
SHA256 b2be2e9546dafaed28ff03dd5c8d7e532a8710fbacd79b41e28bea3e02dd7706
MD5 75aae6c2e148d3fb43dd0afe91e8f391
SHA1 695c47aca990244798b3c89637d80f8f7907139b
SHA512 8dbf89b8843d29ad1d9b2f8e76ef6c8eb38434aafd49dbd93cf0b0079b4191fb8c5fb70ceab14009c47e6ddeedd7c6eca6de7c38637eaed9a08c1e0227e9616f
SSDEEP 12288:si4g+yU+0pAiv+3dOeGZTeesqXwLzXRaIzsVYxUlvjosTdcG93Dn:si4gXn0pD+NOdtBsqXwLlamsVjlvjRhr
TLSH
T101C4F1313592C037E6A604314BE5DBA6667A79B6476278DF37C42B7E2E702C2D63430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4904	24E3.tmp
4748	2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	24E3.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4904	24E3.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 4904	5796	2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe	89
PID 4904 wrote to memory of 4748	4904	24E3.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Users\Admin\AppData\Local\Temp\24E3.tmp
  "C:\Users\Admin\AppData\Local\Temp\24E3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe 2280B448D31766784CDFE6B50FCD36C9F4B5D589019C6F2641AB9FEAD675D11B1189BF91CC8A83CA4019DBCC7EE7129ED42394D75FCBAA32A06FEE05FED1BE03
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4904
- - C:\Users\Admin\AppData\Local\Temp\2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:4748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-07-29_75aae6c2e148d3fb43dd0afe91e8f391_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

24E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\24E3.tmp
Size 535KB
SHA256 e61873b14564b817cd5cb6dee5c44c57fa57f42ba616edc13a3113fa2872d78a
MD5 e27110f76fc7a2acaea07e7d212705ba
SHA1 12b60fb6a9869f051945718d543f0d40211199f3
SHA512 eaf41cd853b41af92aebe6b162cb54ec27fb41a3258d3f710adea9f930806c25bd53508d9212f8e3958fd256833021a0f4e80331507e2ce4fbd146b7bccf983e
SSDEEP 12288:si4g+yU+0pAiv+YC+Sg+/iH0Eb/vcNjJotMxUlvjosTdcG93Dn:si4gXn0pD+YC+SgsfETvbvlvjRhFJ
TLSH
T1D7C4F1203692C037E2A715354BF5CB66667A78B54B25A8CF3BC42B6D2EB43D2D634307
MD5 SHA1 SHA512 SSDEEP TLSH