93b48bbee9c288c27af5517c549d6048918c3767d8ec18f02af7fdcfd45dc8d5

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 09:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_3a499dd549d5c743efb3d7af6f9d6f14_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260731-lk4gnazdkc
SHA256 93b48bbee9c288c27af5517c549d6048918c3767d8ec18f02af7fdcfd45dc8d5
MD5 3a499dd549d5c743efb3d7af6f9d6f14
SHA1 2b37614ea01dc090a4873f97fa45c3f10026de79
SHA512 a5e7c91e0e4f25549f1d57cf446d27dcd3f8f04485be11b325883cc8a767ce121a1c4d07a86f4a09867275ac3fc28656964dfb20b4765ac02bf725f9bb08da6d
SSDEEP 12288:gZLolhNVyEdkuOyxxa/tjVhZulHU0J32qHR:gZqhOE2exxCVrufx
TLSH
T15594CF2872C1C032D19301314AFADBB2153A7DB15F6165DBB3983B7E1EB12D1AA7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1480	E594.tmp

Executes dropped EXE 1 IoCs

pid	Process
1480	E594.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_3a499dd549d5c743efb3d7af6f9d6f14_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E594.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1480	E594.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5532 wrote to memory of 1480	5532	2026-07-31_3a499dd549d5c743efb3d7af6f9d6f14_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_3a499dd549d5c743efb3d7af6f9d6f14_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_3a499dd549d5c743efb3d7af6f9d6f14_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5532
- C:\Users\Admin\AppData\Local\Temp\E594.tmp
  "C:\Users\Admin\AppData\Local\Temp\E594.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-31_3a499dd549d5c743efb3d7af6f9d6f14_elex_mafia_stealc_tofsee.exe 5FCE856F09638B2411F4C5FB505AA43019D6E7819F6F682C7BD27D97B8E789E324DE1B20893AA2472ECC2C1244DA136941CA1C71D69572F59A8DBF42DC2FEF2B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E594.tmp

Path C:\Users\Admin\AppData\Local\Temp\E594.tmp
Size 428KB
SHA256 5975a15babaf88b1a257b14c03005d05be0f56e1b5962544847ae218c03a0c46
MD5 e0e440045bc45f3edc5fc4973745152b
SHA1 aabf260fec8895ccfc69b69fe9b7eb9bc81e4ea1
SHA512 33fd4570d95b03dc961900c75abb94843e79adfbcf0a1767963a319cde4171d7d13d7e6aea7338caf1fcd3b745cee3ec4503d45bb654a1c07f922b232b81fcb6
SSDEEP 12288:gZLolhNVyE6QaBSBCjGchzAoy79XN8g27pqHR:gZqhOE6Q5tVNvz
TLSH
T14F94CF24B2C1C036D093013147B6D7B6563ABDB15F6164DBB398377E1EB02E1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads