5525596b1f0061adbbabb180520a65da2a74f87aeb5087ebfe1840212ef9837e

Analysis

max time kernel
148s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_798774bf12ffdc993f39e1ed3a63cbdc_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260802-wl21bsycpg
SHA256 5525596b1f0061adbbabb180520a65da2a74f87aeb5087ebfe1840212ef9837e
MD5 798774bf12ffdc993f39e1ed3a63cbdc
SHA1 a7ae1074495c241db328269a6e7c93a65cd88170
SHA512 c273449ed31f4e3e4a8d18a542025e58d6dce56327494974d14192276044aec3229639b85f07afaf5bc1cb20a38e3ce01f2e1bd505e4c0619bfc320593ab77f1
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnlh0+J+wQMPUh5dDy8lF9m99d2Unh7DYitP:U6PCrIc9kph5LzRCDDT9mEEl
TLSH
T18694E1243581C037E5D306318AEAD766293E7E754722A8C77BC467AE2E752D1EB38307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4296	2D30.tmp

Executes dropped EXE 1 IoCs

pid	Process
4296	2D30.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_798774bf12ffdc993f39e1ed3a63cbdc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D30.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4296	2D30.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 4296	3556	2026-08-02_798774bf12ffdc993f39e1ed3a63cbdc_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-02_798774bf12ffdc993f39e1ed3a63cbdc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_798774bf12ffdc993f39e1ed3a63cbdc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\2D30.tmp
  "C:\Users\Admin\AppData\Local\Temp\2D30.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-02_798774bf12ffdc993f39e1ed3a63cbdc_elex_mafia_stealc_tofsee.exe 926BF1C53E45AC89A6351603F76A59CA43CBF148896E527AB96869B6FC4FF39633380907C81D09C267F2A842DE2934BC3CF16E6B53C783F13F6EA28A15C8A81A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D30.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D30.tmp
Size 412KB
SHA256 f53a6e08f91e32ae6addb509bf590894b7c457b1f4de219287a66a7c5a082309
MD5 46383741d17d9453b4a50f2584b598ad
SHA1 c7a9fa6ff58df59e2caf26b4c8c97bc535b163d4
SHA512 b4791d32da6476f7408ad833d1307d34a93a491026084749252ffbdd3c66711f1b552551c768f0a47fbb7a4d5cc814c2d3aae337309bd014321a2bac4bd310ed
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnlFoMDKwDmNYfgOn0o6CuRjS89+YzQWaSNP:U6PCrIc9kph5JTYOnwRNMYzQk
TLSH
T1AE94E0343581C037E5A306318AEADB66192E7D754B22B8C77BD467AE1E706C1EB39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads