460cba4c9102b619ad1968869db2f8313bfd6066ef557427245d3aecf91debf7

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_5aed6b84b6cb1729190dc0b0a9d51a92_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260802-w4jayaea92
SHA256 460cba4c9102b619ad1968869db2f8313bfd6066ef557427245d3aecf91debf7
MD5 5aed6b84b6cb1729190dc0b0a9d51a92
SHA1 20a0c504ce4fb83221ba5b29bba908401dedd122
SHA512 dd870c023788e8c23840b4bc3b8cf44f98e67e6a098d0c3a70eb217ebdc2ff3b0346f632519918eaa2592c7332d2f748b26d1d352d93ee2a1dfb703bafba2bd0
SSDEEP 12288:dZLolhNVyEFQzptEWTI4ZXTixZwT/sqHg:dZqhOECNtY4kxajO
TLSH
T19994D028B2C1C036D19301314BF6DB76193A7DA15B6264CBB7983B7D2EB43D1663A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1568	81E8.tmp

Executes dropped EXE 1 IoCs

pid	Process
1568	81E8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_5aed6b84b6cb1729190dc0b0a9d51a92_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	81E8.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1568	81E8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 1568	4880	2026-08-02_5aed6b84b6cb1729190dc0b0a9d51a92_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_5aed6b84b6cb1729190dc0b0a9d51a92_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_5aed6b84b6cb1729190dc0b0a9d51a92_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\81E8.tmp
  "C:\Users\Admin\AppData\Local\Temp\81E8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_5aed6b84b6cb1729190dc0b0a9d51a92_elex_mafia_stealc_tofsee.exe 0A4EE96AEF96035CC4BB475053ACD1C98379D7C845D648F9B236AEC5F50F26FB6A89B1FDA0616DF63DD777FEA8007BDA0D64BAFDB50AA250C63E6E3BB3164415
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

81E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\81E8.tmp
Size 413KB
SHA256 847d461815f6eef153495957040da0aa421389453ec38b7567389a35cb49779f
MD5 1ee54ed4f7bb176d52cf303cf3280322
SHA1 3a76f9b54d4cc05ca85d3af3778734a6cf20a76a
SHA512 56d6fa9725ef6076f17c3c04bda836a82f9f6e32856df718ba3d53f44f33427b9d5cfbd45a44e477b7e27f3bb7b3de9af0b1cb59e6c09c50dbc4796165b240d4
SSDEEP 12288:dZLolhNVyEqfwUx2826BHTdMZ+MuPX0AdN7zgrqHg:dZqhOEcxHxi+M0F70z
TLSH
T1D694D024B2C1C036D59600318BF6E776253A7D715B6264CBB798373E2EB43D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads