292e9ee161c979b75cf0761c7a8b71a05cded95b0975f48f8af2ed7ba13bf404

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_c1d0aa338079170b09ec2d6efd0444ee_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260730-nakb5swdqa
SHA256 292e9ee161c979b75cf0761c7a8b71a05cded95b0975f48f8af2ed7ba13bf404
MD5 c1d0aa338079170b09ec2d6efd0444ee
SHA1 9aeca80420d0bcc89fad1fb8a63465e84dcd589a
SHA512 bbe1a1d5172476d556d2d1435c4963be567b302f981941ec4ec4956498d843ca6ccdaa72b6d4cd541aab475e0a5954827b5b2417da2e24dc15311cabc0d00241
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnXk8sJx7ePIuNMgghDYfyIvo024dHdLvgzepP:U6PCrIc9kph5+8sJxo5ghCfJXzWU
TLSH
T14A94D0243581C037E29305344AEADB67293E3E715B25A8D73BD46BAE6E703D1AB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3876	AE57.tmp

Executes dropped EXE 1 IoCs

pid	Process
3876	AE57.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_c1d0aa338079170b09ec2d6efd0444ee_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AE57.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3876	AE57.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5796 wrote to memory of 3876	5796	2026-07-30_c1d0aa338079170b09ec2d6efd0444ee_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d0aa338079170b09ec2d6efd0444ee_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d0aa338079170b09ec2d6efd0444ee_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5796
- C:\Users\Admin\AppData\Local\Temp\AE57.tmp
  "C:\Users\Admin\AppData\Local\Temp\AE57.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-30_c1d0aa338079170b09ec2d6efd0444ee_elex_mafia_stealc_tofsee.exe 496B2C33C58A0507CF92ADF2BC0E8A961659590122C17C638314A522F363B01F89F399A8F1213C902FDE11DC4A4979308896272B332828842F5A704600CA47C9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AE57.tmp

Path C:\Users\Admin\AppData\Local\Temp\AE57.tmp
Size 412KB
SHA256 f6dc3250c1ae0cfb1b65d5412c62034e75eda08d6c7c856969d158f7f28f7f39
MD5 06c24526d3091e37ee682a8ae83f354c
SHA1 7de401a6900c58fd64c7f762298ff60ccd7b4ec1
SHA512 9c34fc8ba9babaf162e7ea38952ca440bd8e5ffacf4f85189345ad224338b2c58128f50baa178758d466d1a72345cdc3c24e282c93970c8c51631b3a3a5067d2
SSDEEP 12288:U6PCrIc9kph5rZXmMzXvpgjfrEMmnAFGCql:U6QIcOh5rZzzXxz/YZ
TLSH
T1DB94D0243681C037E29305304AEADBA65A3E3D755B26A4D37BD06BAE2E743D1DB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads