e018006f0676309dfb1a13ee54ef9335e94cffc71ef59c63991f5a7019e255c0

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/08/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_edb10254ef5b50318b3e7d5449799808_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260801-sxp85assbx
SHA256 e018006f0676309dfb1a13ee54ef9335e94cffc71ef59c63991f5a7019e255c0
MD5 edb10254ef5b50318b3e7d5449799808
SHA1 2fd45bb48ebdf997da24144001c6044b2311664a
SHA512 b5d2180cf4afc56a83c829e176caaf4d926382ed4d702bfd0c2775748908030bf0f7c7bf19ac46c42549a2d1b2f2e0a1f12017b46c607477464cfe31d68dce8f
SSDEEP 12288:gZLolhNVyEdJ3sUS6Zvi2tIIB7jtNgJqH:gZqhOE73sUV1iaIId
TLSH
T1D094CF24B2C1C036E59605304BF6EB76193A7DA14B6264CBB3983B7D1F713D0A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1872	8B3F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1872	8B3F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_edb10254ef5b50318b3e7d5449799808_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B3F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1872	8B3F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1872	4900	2026-08-01_edb10254ef5b50318b3e7d5449799808_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_edb10254ef5b50318b3e7d5449799808_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_edb10254ef5b50318b3e7d5449799808_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\8B3F.tmp
  "C:\Users\Admin\AppData\Local\Temp\8B3F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-01_edb10254ef5b50318b3e7d5449799808_elex_mafia_stealc_tofsee.exe 64006898D7C876AF360B93222D5312474DF0B3C05ECB027A21D8C4EFDDFDEDDF95F994063CBFBF02452380DA039289311C39BA1973F0FB80F2A26CA3CC79143C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B3F.tmp

Path C:\Users\Admin\AppData\Local\Temp\8B3F.tmp
Size 411KB
SHA256 68f3ea69920867c73331537e7ec429eb834b1616c0fd7dac721a65ce13e5ef8d
MD5 83c14efbab8e80c654c12bccab60693b
SHA1 d60236c284dfe785944b247e366d530ff3509b81
SHA512 b55f464a966a15eae3253ff434fe91e71bb22329c11eac7fe5ba66bc1dbdb932e1ebd0f153754d11781f687c86dfd2f31656c4fccca5b391f3c04dbbdf5b7a01
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFKGdbkyrEYiBDKq26PbYvyylakrMqH:gZLolhNVyETA4YcDK568vyZqH
TLSH
T1B194D025B2C1C036D19601314AF6EB76293A7DB11B6168CBB7D43B3D1EB53D0A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads