ca42841ee613f9a89b8f98f385be95777955ae6bbcdd979bb99d628fce2d70ed

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 17:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_7574f285cc68bff429bb3b1ea0280a9f_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260803-wdvw2sdb69
SHA256 ca42841ee613f9a89b8f98f385be95777955ae6bbcdd979bb99d628fce2d70ed
MD5 7574f285cc68bff429bb3b1ea0280a9f
SHA1 e5fd015d6be630c8fca5259bd298a08c9f6e81d4
SHA512 1a2a1ae3a29e874b2ab4f7800233f75e149e0504ad0716c218c90881ce733fc9207dbd7fc778a793da0eaf9d49905ea1f6d9302fa4ccd167875414f12b8cb594
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFoULJm4K3dRhlwW9oFFefCyGP1jXK5SqH:gZLolhNVyEVU44w/9IF2gP1bKUqH
TLSH
T1BA94D02472C1C032D59601314AFAE775253ABDB55B6164CBB3D83B7E2E703E1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4964	8C48.tmp

Executes dropped EXE 1 IoCs

pid	Process
4964	8C48.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_7574f285cc68bff429bb3b1ea0280a9f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8C48.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4964	8C48.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 4964	5496	2026-08-03_7574f285cc68bff429bb3b1ea0280a9f_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-03_7574f285cc68bff429bb3b1ea0280a9f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_7574f285cc68bff429bb3b1ea0280a9f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\8C48.tmp
  "C:\Users\Admin\AppData\Local\Temp\8C48.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_7574f285cc68bff429bb3b1ea0280a9f_elex_mafia_stealc_tofsee.exe B2AF01379552B414A0C2374573D4332FAB0EB36B95430819FC66667FFB5FD07BBC1D77C6333D7CF35BC26D0C948391B995678210833AB257B3B871E6315E95A5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4964

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8C48.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C48.tmp
Size 411KB
SHA256 a2e43797e5fefe64145c26c9218d75f05912edc8363922ee9563c0c8dbafcbdd
MD5 3cb6f9afc0861a255844b5c010595b3f
SHA1 2efc834d29381875e18dbd60314eec6901605b9e
SHA512 9bc504ec13a251fec6c323d7020c5994dc87e3d77683809de2bf599d6a6b288024edfa5884d180fa511da937a698ec4ff91ed52f223955873816a376c096a9af
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFAqPCu2q5OfL4EoRARRYAWXJjt5eBNzS8XWTqH:gZLolhNVyE9qPCun+4TuNvXWTqH
TLSH
T11A94DF2876C1C036E19301314BAADB76193A7DA15B61A4CBB3D83B3D1FB43D1A67931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads