c25028dbffd49ad1abc47b13503e75c7fed8c3bc14bd04f72e6fc79c89c2ba0f

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_b9a7d49ddce6d647dfc092bc978b43bc_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260803-vlepcsce74
SHA256 c25028dbffd49ad1abc47b13503e75c7fed8c3bc14bd04f72e6fc79c89c2ba0f
MD5 b9a7d49ddce6d647dfc092bc978b43bc
SHA1 a7142d435003865106ce49b77750f65c1c23e35e
SHA512 8a47d261b1078202cde42485f6100f9cbf4723281e2f349573c6e0fa4bf365bbd61908006b73c579da1da7f580b13700d21ed3ba99b55e2a10b379c5a086c271
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnoWrXEvW0W9XUpJDWAmrWHsoM9UI45vcu/TP:U6PCrIc9kph5lXE/zgWHFI6b
TLSH
T11494E0343585C037E29305309AEADBA6293E7E755B22A8C73BD45BAD2E306D1DB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6036	2466.tmp

Executes dropped EXE 1 IoCs

pid	Process
6036	2466.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_b9a7d49ddce6d647dfc092bc978b43bc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2466.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6036	2466.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5320 wrote to memory of 6036	5320	2026-08-03_b9a7d49ddce6d647dfc092bc978b43bc_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_b9a7d49ddce6d647dfc092bc978b43bc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_b9a7d49ddce6d647dfc092bc978b43bc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5320
- C:\Users\Admin\AppData\Local\Temp\2466.tmp
  "C:\Users\Admin\AppData\Local\Temp\2466.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_b9a7d49ddce6d647dfc092bc978b43bc_elex_mafia_stealc_tofsee.exe 7FD65A5DC1C8D72D24B7307B7BC57BF458708EBA3969F90BC847E5B69343BB0CA9F67920C83825C5DB9238D986329647F4E8EBBEB77D4AF12B9A8A7722A5E1A0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2466.tmp

Path C:\Users\Admin\AppData\Local\Temp\2466.tmp
Size 412KB
SHA256 ec4dea285e8e9389f3f45a1b3b05066408e275bf22a4edf539cae28c1c5edee9
MD5 93cbc1495c98ef21d6bfd2fbaac4e06c
SHA1 1d45224cb06c3499a06fc1ca5464968ca622dd2c
SHA512 c597d326c8be5560b01c5417c838f03422ebc2c2393003b23d2f8dcdc43e4055d107690fcbf174f417d70230efd58e2c5f6cd8a4a7c9d57abb80749ee3a8af6a
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnduHefqZWNn2HQqGR9J/nTqMLP:U6PCrIc9kph53u+eIqQqy/nTqML
TLSH
T1F294D0243580C077E19306344AFADBA6293E7E755B21A8D77BD467AE2E712C2E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads