89a2282c147afa3eedb1de486defe1c0e081ac3c176e5cb82df823e44305fe7e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8b606195e3694317f0433af10f63658a_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260802-wb9mesyapf
SHA256 89a2282c147afa3eedb1de486defe1c0e081ac3c176e5cb82df823e44305fe7e
MD5 8b606195e3694317f0433af10f63658a
SHA1 ba651d3723b532137ad09a61f6aa807389d7f761
SHA512 f2c94ca0ee3f806928db8fe2b5d0e4f39245c83d8583bd1de811aaef4450ccb07db28ae37da31b7b0bac586e0764ead8c53cd271a614479016744b602e912417
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFt8GrE+fii72FYupDrRqHI:gZLolhNVyEerE+f+/vqHI
TLSH
T14F94DF2872C1C036D19601314BFAEB76593A7DB15B6264CBB3983B7E1E703D1A67930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
944	1870.tmp

Executes dropped EXE 1 IoCs

pid	Process
944	1870.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_8b606195e3694317f0433af10f63658a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1870.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
944	1870.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1184 wrote to memory of 944	1184	2026-08-02_8b606195e3694317f0433af10f63658a_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8b606195e3694317f0433af10f63658a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8b606195e3694317f0433af10f63658a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1184
- C:\Users\Admin\AppData\Local\Temp\1870.tmp
  "C:\Users\Admin\AppData\Local\Temp\1870.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_8b606195e3694317f0433af10f63658a_elex_mafia_stealc_tofsee.exe 6F2E525876089F041ED5C51416FA159A4450396CD6C34A84A65263053E70E2481E5ACAD8A2CC3D649BF36578A33340C4321DDF7E08F2FDCE46FD86E1E266698A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1870.tmp

Path C:\Users\Admin\AppData\Local\Temp\1870.tmp
Size 411KB
SHA256 a11031948ae28ce40f53e0f85bec5ee0715edd15f0d1015ad787cf0133b2b633
MD5 d87a1d961d6f02859f130c84fa714852
SHA1 61a81102bf373a6a29095541c9afed883a97f1ab
SHA512 899bcd0b5bf9557de0bdb441cd6fc9628db7ff6f55e5a04e735fc6f331af71430be3c0c60254a9d6bdf33d9e87c74236e7a9f84251690f1055a09c53d1e6f05d
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFy44DjK+VC9D0hXuAgONqHI:gZLolhNVyETZ/K+s9D0hXuWqHI
TLSH
T1F294CF2872C1C036E19201354BB6DB76593A7DB19B6268CBB3943B7D1F713D1A63A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads