c722785e72e7396e4533ffc7f1d8136c60813f7ce8be356a02c31fda2c0bd507

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 14:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_3047c29df90fa0f57f8acf3780cb1f32_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260801-rf9e1a1vdx
SHA256 c722785e72e7396e4533ffc7f1d8136c60813f7ce8be356a02c31fda2c0bd507
MD5 3047c29df90fa0f57f8acf3780cb1f32
SHA1 ec9ccf5e7f244690e7a46548333212380275a6e6
SHA512 dee7e6e24fb0e284ae183817bdb12add5e0dd8173894a3fb8bdbc2476cd279c16117ffa4513a6600812a16545d08ddfe2e3445a6c44cf7dd4a37584e60c19911
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFDuKPWN19d4lrNcl9O6LB+SKqHI:gZLolhNVyEkOD+RcS6L5KqHI
TLSH
T14E94D0297281C036E19301304AF6E776153A7DB55B6164CBB3D83B7E2FB02D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5424	53F2.tmp

Executes dropped EXE 1 IoCs

pid	Process
5424	53F2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_3047c29df90fa0f57f8acf3780cb1f32_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53F2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5424	53F2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2560 wrote to memory of 5424	2560	2026-08-01_3047c29df90fa0f57f8acf3780cb1f32_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-01_3047c29df90fa0f57f8acf3780cb1f32_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_3047c29df90fa0f57f8acf3780cb1f32_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2560
- C:\Users\Admin\AppData\Local\Temp\53F2.tmp
  "C:\Users\Admin\AppData\Local\Temp\53F2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-01_3047c29df90fa0f57f8acf3780cb1f32_elex_mafia_stealc_tofsee.exe 5329504EF764A52095E8FAAF47F3A295944EACCCE01EDC919BDFA7F8E5EA35276A1D4B0E8B35504964E0BD79764B3A3B880C2727BBF5BE86BA149463610C1C91
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53F2.tmp

Path C:\Users\Admin\AppData\Local\Temp\53F2.tmp
Size 411KB
SHA256 643115a9a761afb9958414016d3204eac71f4ab3b61a35482e486e80a85336ba
MD5 47db72b5be9ce76cd3c648fc5a806d71
SHA1 033bb2c51df5ffabe844c6298f50286d1a72e825
SHA512 ef438b3fb0a47dd99de22e841d8d7876f12d95a3c372e4d6ee21ed425e0bfc6ce1e9ee5581c230c3ea72b6f732891f6b2ae92784db5a1529d409e83ed28c8c51
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFFtYFFCvKuJKSF8PwyR8GpZRYJ9FTQqHI:gZLolhNVyEHFFw1kSF8DWCYMqHI
TLSH
T14294D028B281C036D19301314BB6DB75253E7DB15B6264DBB7D83B6E1E713D1AA3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads