fd45a43a61a0c6570fd42ac3835f406e888f1412620aefc1245e0010b9b2f9da

Analysis

max time kernel
148s
max time network
120s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 06:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_9151f4475ff0af27db2e02709caace1a_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260803-hmdr8s1akb
SHA256 fd45a43a61a0c6570fd42ac3835f406e888f1412620aefc1245e0010b9b2f9da
MD5 9151f4475ff0af27db2e02709caace1a
SHA1 b9b4d71f5bf2da855b087f431f4a3ff6f4cb4fd8
SHA512 9563a69bc86ff983ff2c42917fff316e72dc79fd29a8db0dae575e54f71467d746b51cd406692c8c4ba310163e923164005792b9fb03568afb09d5153d34e4c7
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFIuWhc724XrxagI+XNVxBnZ7u0qHI:gZLolhNVyE5N+bm+9pZjqHI
TLSH
T18094D0297281C036D49204318BFAE775253A7DB15B61A4CBB3D83B7D2E703D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2440	3639.tmp

Executes dropped EXE 1 IoCs

pid	Process
2440	3639.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3639.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_9151f4475ff0af27db2e02709caace1a_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2440	3639.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2964 wrote to memory of 2440	2964	2026-08-03_9151f4475ff0af27db2e02709caace1a_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_9151f4475ff0af27db2e02709caace1a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_9151f4475ff0af27db2e02709caace1a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2964
- C:\Users\Admin\AppData\Local\Temp\3639.tmp
  "C:\Users\Admin\AppData\Local\Temp\3639.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_9151f4475ff0af27db2e02709caace1a_elex_mafia_stealc_tofsee.exe A468D777FE9917701F1D01B68801BBD778EB06B587B8E6721B561DF46AA65FBABEFCC3006E3DD839A5092860635788A4C3E294B05EBCDEA3DD27D4BB685170A0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3639.tmp

Path C:\Users\Admin\AppData\Local\Temp\3639.tmp
Size 411KB
SHA256 c1189492d20870f9ade2fdc3ab2b5cd37ad6a98c8890984100d4902e29247616
MD5 f9cda2d51fe3a45757eeef4ae535f654
SHA1 f63bac2b8c386e5e23a312c2eb5c35f52494419b
SHA512 be25836fabaddf7297d229286e2ad3af1870636c5e9138e39ec9e624979bb25c41009eba0298c20bf2f931891a559e5992ec56591cb4d609bc933c2b91390b60
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF8Q6AG0XZyld5pZMfAb3gV4EqHI:gZLolhNVyE/Q6Oyld5D3b3gbqHI
TLSH
T1CE94DF25B281C036D59301318AFAD776153A7DB15B6164CBB7D83B7E2E703D0AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads