304b6eea248e0a23d8ed64feaf1dea745cdd2a4a2847aa6c5de4ac0ccfb8e2c9

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_ca1534e47e578ad0df8f01ae8243563c_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260802-vcrmkach67
SHA256 304b6eea248e0a23d8ed64feaf1dea745cdd2a4a2847aa6c5de4ac0ccfb8e2c9
MD5 ca1534e47e578ad0df8f01ae8243563c
SHA1 0249061eeb91b049a1587bcf59865dba3818290e
SHA512 17eaf7587839ee112e612e44d1281b42ebe22ce1bba55c17193febca4d0a2e4fd67658454c63c7f5e0795b1c70f6b96419612b0f7ec8ebd9f7d217eb196fe82c
SSDEEP 12288:gZLolhNVyEUnxypnB1luF+h8TImzi0qHI:gZqhOE4SnxyTI6i+
TLSH
T18A94DF24B681C036D19301314AF6DB75193A7DB15B61A8CBB3D8377E2F742D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3244	F911.tmp

Executes dropped EXE 1 IoCs

pid	Process
3244	F911.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F911.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_ca1534e47e578ad0df8f01ae8243563c_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3244	F911.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 3244	2128	2026-08-02_ca1534e47e578ad0df8f01ae8243563c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_ca1534e47e578ad0df8f01ae8243563c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_ca1534e47e578ad0df8f01ae8243563c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\F911.tmp
  "C:\Users\Admin\AppData\Local\Temp\F911.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_ca1534e47e578ad0df8f01ae8243563c_elex_mafia_stealc_tofsee.exe 264F6FE114171B4F93EED3E4E85429B3A3FA63AF40B58A353FC04EBFE307D81861D50A55ECC76C34680036C87F98B9B573948A568CFE9FAB8A201638700C5669
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3244

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F911.tmp

Path C:\Users\Admin\AppData\Local\Temp\F911.tmp
Size 411KB
SHA256 c30b4ad399eef382be8ab6d7fd2f36eebb285d2d75b30024978cda371d798c75
MD5 66d3fd266b2ccaf81276d146ee918fb1
SHA1 4b5e858d8ef182e83e2190d03489f8865078dd18
SHA512 97223aa85724e77db101540ccf4b18a53cdd89103d221c538d62171330eafa7e772bf820310ec7defc333ecb538272c4316843d327490fa7a2942b38457fb188
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFwIBKVkI/E/+RlWgU8GJQNW/1dXrt3qHI:gZLolhNVyEpIBKD8/vgc8W/1dbt3qHI
TLSH
T1C394DF28B2C1C036D19301314BB6EB76653A7DB55B6164CBB3983B6D2F703D16A7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads