e2c2f415bffc3e1cfb0c8250122815f13adbe8ef439f5fe304835bf08f0c2fed

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 22:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe
Size 981KB
Sample260730-2h3eksydle
SHA256 e2c2f415bffc3e1cfb0c8250122815f13adbe8ef439f5fe304835bf08f0c2fed
MD5 3e686fc92a0f2794b835312069f1d21c
SHA1 1f3f61a121268df65cd29c9a5436b29e4d8e7230
SHA512 c09e3bde93551ff788f6623b3de7d4dae9ef934f9805dcbc41b609b9ca04d34e8375f1339c6680e51acc0dbb95f31ce1b7c4362d323c9ab0a189814b34d6241e
SSDEEP 24576:FXTo8VZE0p0sorDbaLZmym833ofI+Xf5xbPh:FXTo8LE0psDCZmym8SPpP
TLSH
T1C9250111F9808076D1DA29360EF987120A7A3EA647E674C777C47B193E72CD1A33936E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5848	8D04.tmp
4216	2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8D04.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5848	8D04.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 5848	5496	2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe	89
PID 5848 wrote to memory of 4216	5848	8D04.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\8D04.tmp
  "C:\Users\Admin\AppData\Local\Temp\8D04.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.exe 66A672CA0D14F0118A6DD62388FE45DABA0DF8FBAD4D18C5B840C171B2E7F57E6F6E5C37E780BC4B1961EA5BA322F35DCEC6751FE04C2432A6CD2EA936652E88
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5848
- - C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE
    "C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:4216

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-07-30_3e686fc92a0f2794b835312069f1d21c_elex_mafia_stealc_tofsee.EXE
Size 1.4MB
SHA256 98987578c600dd5a8789ceff6dd031e11807b5b05eececc0566feee1485e6ca7
MD5 2300108f6605bdcd33dc98c7a321671d
SHA1 3d77097930b85bba06e5ed9f37488f6d099ad63c
SHA512 1dd276c53b2917b1c0bec26d6670a86988d2893959df86e014c2ce8b3d0230896f7c8789e072f5ee44f4b0e0754a9aa643e42e3ae5c8167fc74a24815b2c837c
SSDEEP 24576:2LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQTZ2:yZmQyaJ1ZmFcqi+SRAG+X
TLSH
T109655BC3F90181D8FCA92D754C3E5E401AA13FABA6C43C1A609E770639B3C93566B95F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

8D04.tmp

Path C:\Users\Admin\AppData\Local\Temp\8D04.tmp
Size 981KB
SHA256 aaa355fe611dd5670aa2f1cf1bc70d1c1c2e28eed7eed5993889bd750cafe3be
MD5 57bd419e12e498e321dee24ee8b9f1b5
SHA1 3470c4452e3ffc262f74b0e7f30d963a8f98cf1c
SHA512 db38ff7e42459e720340e77b7d9d998563ff223549bb06fd71a16752b7c90449388461df24e2e914ae1af69db86f04edb5240fd681de5c24da36616ca0dfd77e
SSDEEP 24576:FXTo8GCF44ve+Y6SLZmym833ofI+Xf5xbPh:FXTo8rPvNr+Zmym8SPpP
TLSH
T1B6250111B9818072D1DA2A320EF9C71109BB3EA747E6B8C767C07B153E72CD1973929E
MD5 SHA1 SHA512 SSDEEP TLSH