400d7b8de54181ab858a79d297ac06b5de24d50dd5ee9a44deb0bfb8e5fb0100

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 17:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_83f69d965e6d42adf9fdf46edc47273e_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260802-wfmcpatzht
SHA256 400d7b8de54181ab858a79d297ac06b5de24d50dd5ee9a44deb0bfb8e5fb0100
MD5 83f69d965e6d42adf9fdf46edc47273e
SHA1 8586fde7250e502a631a7cc7340caccb1639d50f
SHA512 a04e9a3485dc1e44d3c542a83b07d9c8e183f0f9f823fcf80c9e25faef45455e50b180bc363768771b946a7a5093f512b8970929385f96592880208459efcf88
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZncK/KbSBGEKbJ98v1S1BWiR5FT4mP:U6PCrIc9kph5y1SBGrbPfRrf
TLSH
T1FF94E0243581C137E2A302358AEADB66193E7D764B2264D73BD067AE2E713D1EB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3424	553A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3424	553A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_83f69d965e6d42adf9fdf46edc47273e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	553A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3424	553A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1816 wrote to memory of 3424	1816	2026-08-02_83f69d965e6d42adf9fdf46edc47273e_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_83f69d965e6d42adf9fdf46edc47273e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_83f69d965e6d42adf9fdf46edc47273e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1816
- C:\Users\Admin\AppData\Local\Temp\553A.tmp
  "C:\Users\Admin\AppData\Local\Temp\553A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_83f69d965e6d42adf9fdf46edc47273e_elex_mafia_stealc_tofsee.exe AD53303077EA18A77E74DA21F885F23747F0895538BB82C1671C9FAEB9F4D256F763F49FA7D42DA3BE419CF7FD54C11EBA6342C8A0F6F2E0405F958C94AD43C2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3424

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

553A.tmp

Path C:\Users\Admin\AppData\Local\Temp\553A.tmp
Size 412KB
SHA256 04a4d617fdcecc94b639db97b7d998adefc43736db29b62d0aa42c8e49e453eb
MD5 9ceeb6839cda016dc371c7b40acd4754
SHA1 fd3de791e20668850fa49d5b4a9e5dd4dfa7f28c
SHA512 851e368cd52ac881f401a124bcec06dfb3c9c3292192504b168e15e90edc19a343ca51f5b0c09c14e667c9645e4ef20b688305f939f30d805fb094678a91bb32
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnTYlRjT804t1uiKsvvljSguuExR34FrSP:U6PCrIc9kph5EBw0g1xJ3ljLi4xq
TLSH
T1BE94E0243585C03BE29305304EEADB66693A7E754B61A8C77BE467AD2E703D0EB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads