6aa9eb181069cc9fc1a8ba7abe2a00983de6bf68c2bd6145dba44dff3493dc44

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_6198aec2272160d417cf37952c40eef6_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260803-wmvmmsvdja
SHA256 6aa9eb181069cc9fc1a8ba7abe2a00983de6bf68c2bd6145dba44dff3493dc44
MD5 6198aec2272160d417cf37952c40eef6
SHA1 ec6e6cf0274f73d50b5a6047bbc6ec7bb7e0c857
SHA512 6d3d361bb89c852020cab03bcc406f1ffc5474e9649233a6d4f2764a3a958f00c30d431298d462cd5effbb6ea1383d43dbe8885dc31c5f26079507f3a580e750
SSDEEP 12288:U6PCrIc9kph5T+fSQllhbZvocquwERFdlB:U6QIcOh5oS2lhtQczTN
TLSH
T16694E0347581C136F59305308AEACB67293E7D654B22A8C73BD46BAE1E753D1AB38307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4460	DE84.tmp

Executes dropped EXE 1 IoCs

pid	Process
4460	DE84.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_6198aec2272160d417cf37952c40eef6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DE84.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4460	DE84.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3424 wrote to memory of 4460	3424	2026-08-03_6198aec2272160d417cf37952c40eef6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_6198aec2272160d417cf37952c40eef6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_6198aec2272160d417cf37952c40eef6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3424
- C:\Users\Admin\AppData\Local\Temp\DE84.tmp
  "C:\Users\Admin\AppData\Local\Temp\DE84.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_6198aec2272160d417cf37952c40eef6_elex_mafia_stealc_tofsee.exe C6970619556686B81A954F83B1B72530BD246AFCB053BE6BD241DA7ED4CBE3B426199E29326F817E366267476522D28C38FB0AD1B4932216E2F80383AFCB0542
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DE84.tmp

Path C:\Users\Admin\AppData\Local\Temp\DE84.tmp
Size 412KB
SHA256 fd0a9f22eeb99dfc6119ffa3521333a11fa735177c920e609deb3dcf7e04add4
MD5 d47b9701578d6078b537aaf10955f0b0
SHA1 893f4214a02b10b65bc911cd7bb64d97fa04c073
SHA512 da481682736a640eb92c04e6caef7d95bb72e66273686cfe8ddb1c9b1d9c1d3e7f47bb96668c986048c10144c7fa94754f373030ba3bca19c66b1dc06bb01cb2
SSDEEP 12288:U6PCrIc9kph5HFWnFn1HPo/rhds4yB00/Uj:U6QIcOh5HUO/rhS50J
TLSH
T1A294D0343585C036E6E315304AE6CB66193E3E759B26A8C72BD867AD2D743C1EB39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads