e9945c55a8c3c53c85464eee4f986af4d269a6ba0cdc6653bbd9802161632ba8

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_159686edb1c29fc8779bc592df335d2a_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260730-gnmk4a1dlf
SHA256 e9945c55a8c3c53c85464eee4f986af4d269a6ba0cdc6653bbd9802161632ba8
MD5 159686edb1c29fc8779bc592df335d2a
SHA1 88d280a9117250a5e93d64d1a5a5c20dbfeb9251
SHA512 13b76f7e459a1a5ad415bb03505ac02e7737105fc240553df269affdfc7bb0b2362f5887c9452653b9d759b5e81373e743596024a50a07f35e32d2e2ddd000da
SSDEEP 6144:mVdvczEb7GUOpYWhNVynE/melcRSjcsVegA7QnWz0UpXqAI9o1ZCiNRYsq:mZLolhNVyEdcR+0j6ziZjYsq
TLSH
T1DB94DF24B6C1C032D19315314AF6D736593A7DA54B62A4CBB3983B7E1F703D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4624	9428.tmp

Executes dropped EXE 1 IoCs

pid	Process
4624	9428.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9428.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_159686edb1c29fc8779bc592df335d2a_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4624	9428.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 4624	2268	2026-07-30_159686edb1c29fc8779bc592df335d2a_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-30_159686edb1c29fc8779bc592df335d2a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_159686edb1c29fc8779bc592df335d2a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\9428.tmp
  "C:\Users\Admin\AppData\Local\Temp\9428.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-30_159686edb1c29fc8779bc592df335d2a_elex_mafia_stealc_tofsee.exe A0E431B332783D3E12C3F9FC4898BC0DE3D427C4F0354D2E775BEF200CEB84070F3BFE45D65226BF4875253D43215024BD768BF5BEE73139DEB719E23FCBCDFA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9428.tmp

Path C:\Users\Admin\AppData\Local\Temp\9428.tmp
Size 411KB
SHA256 ee981e94eb60c0a09c2b1cd2bfa8a0ee6c3374fc7fd8bfa80f459b850068a0af
MD5 3b35d7c6087d135ef4e33d03d498f601
SHA1 0c62271362ae142b595c99b794ebff9f73095d9b
SHA512 cd6d67ec536fc67fa3e8b449106d9e6239155cdfa21f661d5a0349d19108503af3cd3e6050d085f087bd1cd28e968dafb047d7427e48cf46a0090b01e065e2c6
SSDEEP 12288:mZLolhNVyE3Ed4MMxREu1VGfZS9blD9H7q:mZqhOE3Ed4XRN4MvDV
TLSH
T1AC94C02872C1C036D19205314AF6D7762A3A7DA55B6164CBB3D83B3E1FB03D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads