33e53e75cfed8ac4a24a14e54cac174fb81835aaca00787d726bb625c3100ac9

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e224cef16758bc70c54298743c67cf7e_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260802-tymp3asxav
SHA256 33e53e75cfed8ac4a24a14e54cac174fb81835aaca00787d726bb625c3100ac9
MD5 e224cef16758bc70c54298743c67cf7e
SHA1 d062986f7b85dad7e51ae077638263a0b4fa2afe
SHA512 b1c935d052bbca443ccf705a6df2f539e6687f465c8fb9ebb9b2bace9dd5543859202c1ae68970aaf68a0495d5927084db65e6105f5e5305e542dcac96f0566e
SSDEEP 12288:U6PCrIc9kph5rahmkyguJAYz0ragpjemh:U6QIcOh5KNyqlragZe
TLSH
T14A94E0243985C033E6A206358AEBDB76693E7D754B22A4C77BD057AE2E702D1E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5904	1831.tmp

Executes dropped EXE 1 IoCs

pid	Process
5904	1831.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e224cef16758bc70c54298743c67cf7e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1831.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5904	1831.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3332 wrote to memory of 5904	3332	2026-08-02_e224cef16758bc70c54298743c67cf7e_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e224cef16758bc70c54298743c67cf7e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e224cef16758bc70c54298743c67cf7e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3332
- C:\Users\Admin\AppData\Local\Temp\1831.tmp
  "C:\Users\Admin\AppData\Local\Temp\1831.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_e224cef16758bc70c54298743c67cf7e_elex_mafia_stealc_tofsee.exe D6A88DB0E7825A9D7FDB42FBB6F5338684D77075574D06C40A259BB277CC3F13F77CB11DEA3AF98145C5136B58CC79E177FB812C07702B7D27421ED162AEBF9B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1831.tmp

Path C:\Users\Admin\AppData\Local\Temp\1831.tmp
Size 412KB
SHA256 7bac9be81854b2bb35c0064bf0dd51eb625c8cee04c12afd5911864b73c681db
MD5 57e12917ac111a949e5f859c2a70d978
SHA1 e1382709e88ec042d0424f735cd080b429df74e1
SHA512 62806676ac510ef97a9a1621ca5f4020ddc8082e23842897861e255e418e85c7ff6ba95dcc003efc857347edd2ca850ab582c5762b402e60d412ce6b115d056f
SSDEEP 12288:U6PCrIc9kph5VFWyVEhkyJqNaf1yo8ma:U6QIcOh5yyAq0tyo8
TLSH
T14794D0343181C076E6D306308AEAD766293E7D755B22A8C76BD46BAE1E743D1E738343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads