214aa0e1a3cce1ae4744c96d2d0cb4e0c122fea6983a60edfdc72f7ed575bdbc

Analysis

max time kernel
150s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_78288c6b533f65b850828ca7aa86c121_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260731-we78rsdk81
SHA256 214aa0e1a3cce1ae4744c96d2d0cb4e0c122fea6983a60edfdc72f7ed575bdbc
MD5 78288c6b533f65b850828ca7aa86c121
SHA1 9edca255626b2f0fcc323e915bb2380f1185f54b
SHA512 160b117bc139e180803f5c7c0cd8dd9b4d89a444bf90501de7c5c4f1254251ecbb12f75d8e47adf709c38a3dd6b5eceb9fba5658681930e7e9252fbc0376d73e
SSDEEP 12288:U6PCrIc9kph5ShG3aRMqikpddZdcA17LOz6A:U6QIcOh5ikzXkpddZdH17LY
TLSH
T1AB94E0343581C037E29316308AE6DB66693E7D765B22A8C72BD45BAE5E703C1EB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5308	4740.tmp

Executes dropped EXE 1 IoCs

pid	Process
5308	4740.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_78288c6b533f65b850828ca7aa86c121_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4740.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5308	4740.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 5308	3380	2026-07-31_78288c6b533f65b850828ca7aa86c121_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-31_78288c6b533f65b850828ca7aa86c121_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_78288c6b533f65b850828ca7aa86c121_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\4740.tmp
  "C:\Users\Admin\AppData\Local\Temp\4740.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-07-31_78288c6b533f65b850828ca7aa86c121_elex_mafia_stealc_tofsee.exe E8C58086BDF6F2105211446323A3DA6133367E3EFBFDBBC29DBC75E44B945E19514CB9AEA16D199807D69C15ECBE19A28FA69A47C3B7A048461CFC810732C747
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4740.tmp

Path C:\Users\Admin\AppData\Local\Temp\4740.tmp
Size 412KB
SHA256 e2edaf001806155b710f4555b3b4aaee4786e3345a2f41e918fb2d687c679cc5
MD5 303f6a2805df739013d3e9682a1b5c93
SHA1 6ba93532568cee08b4e0eafca7601fcc2bdf4dfa
SHA512 19f789493a99584b28f11d998f77e91b16ac038bb9d1eb53747ef0a711f5b015d9ba08dace41a8ffe92c291e207a534aae21e64a0fe629b090582ce39d5cae4a
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnCicE3nlsBZItFSyQs/MNcm1aP:U6PCrIc9kph5oQ3nlsc6yr/a1C
TLSH
T18D94E0303581C036E6D315304AEADB66293E7E359B26A8D77BD45BAE2E703D0A734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads