102da9bec100544fe6407c5167265631d5881ba63a329c23a559cce0320c2892

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ef1220dfe1913f697f15226b120340da_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260802-3ettpshc74
SHA256 102da9bec100544fe6407c5167265631d5881ba63a329c23a559cce0320c2892
MD5 ef1220dfe1913f697f15226b120340da
SHA1 37e8b8d63757827da735649b45b6e11e36ad7d1e
SHA512 d5b7fe5e4a8273298cf4053faccf018cdac55d09a54d780b139792eef3332b3b5fd9de073896094c281aecb96d667e265c9f5d1586a43369af94662d629483a1
SSDEEP 12288:U6PCrIc9kph5nYr3xumol9h9iH/JHa3dw:U6QIcOh5nYrhup9hmBo
TLSH
T12694E0243681C037E2D205348AE6D7A6193E7E755B26A8C73BD45BAE1E713C1EB38317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
368	6037.tmp

Executes dropped EXE 1 IoCs

pid	Process
368	6037.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ef1220dfe1913f697f15226b120340da_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6037.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
368	6037.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3860 wrote to memory of 368	3860	2026-08-02_ef1220dfe1913f697f15226b120340da_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ef1220dfe1913f697f15226b120340da_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ef1220dfe1913f697f15226b120340da_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3860
- C:\Users\Admin\AppData\Local\Temp\6037.tmp
  "C:\Users\Admin\AppData\Local\Temp\6037.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_ef1220dfe1913f697f15226b120340da_elex_mafia_stealc_tofsee.exe 1037B84EB208A1068A19FD19323C39D47A2DD470E52AC4373ADE1BA6D6645859B2F4ACF52C37DE5104E7DE93F64833A589CB7B095CEDD0F5CB0B193FDFE53057
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:368

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6037.tmp

Path C:\Users\Admin\AppData\Local\Temp\6037.tmp
Size 412KB
SHA256 babe61f2a60ed56cbbad67408845d7a9220d4596db05697b7c043764029d544e
MD5 660c499b510d1d8c9bbc56eeb7a37490
SHA1 03b7ed51ae3e4d8c64dc8dd19657eb946893c62b
SHA512 b394b00b785dff4a4ef48eeb78a60be6eabc55068cf55954907d8db77bb6b3936aca0c55cb1d125180376f37156fc962f2f7e69f0358680bd27c90ea5f19f83c
SSDEEP 12288:U6PCrIc9kph5JbVrHtzwmur/vLDyd+VdkSH:U6QIcOh5JBHtz1uLvLDVVd
TLSH
T19D94E0243681C177E19316358AEADB63293E7E35472268C73BD46BAD1E703D1AB38347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads