6a7aae7303c33396e30036ba7e08dd9c7d4a3bfcd49594bfa9a84f9210a918e0

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe
Size 981KB
Sample260730-2ev64agm2w
SHA256 6a7aae7303c33396e30036ba7e08dd9c7d4a3bfcd49594bfa9a84f9210a918e0
MD5 61372590e988fc45f9c0224613151e8e
SHA1 8e7cc1ebddee92996446a7a1ecb7849fc7c852ca
SHA512 0ed63bc784e0c113fd0afdd2de88fe047438003de0de565647e3d86aefd71c0818f46fbcce15bc38ff859e6fcc81ae33b82c6d29087c9a890992d4f27d80f6b7
SSDEEP 12288:FvfTNJw8OLcroCiCOPcCiMKJLZmUAMsNfCL33otGQI+Dt/Xf5xbtJCG0F0S:FXTo8eXEcSLZmym833ofI+Xf5xbPh
TLSH
T1E5250111B9808076D5D629314EF987120ABB3EA647E278C777C47B053E73DC1A7392AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3932	1F94.tmp
4284	2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F94.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
3932	1F94.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 3932	2680	2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe	89
PID 3932 wrote to memory of 4284	3932	1F94.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Users\Admin\AppData\Local\Temp\1F94.tmp
  "C:\Users\Admin\AppData\Local\Temp\1F94.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.exe D17A85F46BABA0BF546A87690E80EB16BD3BAA219FDDF1CC5569BBD54F479135A6A69672AED9EFE67732F28575A9BC235AF8D3E31CFA70833316B3F4F1170162
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:3932
- - C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4284

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F94.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F94.tmp
Size 981KB
SHA256 db48b085a3e523bf1bf3eb94ce20fe7285873bb5843a3c75357b59e3002971af
MD5 47162e7ed193b1a4e8cef2dd713c7cb5
SHA1 b37dcda19ef46a9dd669c36d678f1b616e870ee4
SHA512 169610eacce00c0a400aaff5f1d0cc96bca57fc266d6448f7ba1865b4977941e36294dcd25135c3b83fe7aa44b2dca80af6172e2595dd4d8fa9b5198181fdb9f
SSDEEP 12288:FvfTNJw8Yf7OwSgfgcJUKKJLZmUAMsNfCL33otGQI+Dt/Xf5xbtJCG0F0S:FXTo8u6wSgA/LZmym833ofI+Xf5xbPh
TLSH
T1C6250111B9808076D1DA29321EF5871209BB3EA647E678CB67C07B153D72CD2A73939E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_61372590e988fc45f9c0224613151e8e_elex_mafia_stealc_tofsee.EXE
Size 1.4MB
SHA256 98987578c600dd5a8789ceff6dd031e11807b5b05eececc0566feee1485e6ca7
MD5 2300108f6605bdcd33dc98c7a321671d
SHA1 3d77097930b85bba06e5ed9f37488f6d099ad63c
SHA512 1dd276c53b2917b1c0bec26d6670a86988d2893959df86e014c2ce8b3d0230896f7c8789e072f5ee44f4b0e0754a9aa643e42e3ae5c8167fc74a24815b2c837c
SSDEEP 24576:2LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQTZ2:yZmQyaJ1ZmFcqi+SRAG+X
TLSH
T109655BC3F90181D8FCA92D754C3E5E401AA13FABA6C43C1A609E770639B3C93566B95F
MD5 SHA1 SHA512 SSDEEP TLSH