d0c60e33337f0957d442263113d5f9afcad1f7f6ac9d09b1d60408986a2cb895

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_5cd954a22c47e532f4cb6ade05da10ba_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260803-wp7d8avdmg
SHA256 d0c60e33337f0957d442263113d5f9afcad1f7f6ac9d09b1d60408986a2cb895
MD5 5cd954a22c47e532f4cb6ade05da10ba
SHA1 1d4f68ba7b273fd99d720ac4ed109e301b89bc68
SHA512 f367e2ee66cd30751ca21c6551c85362969f3e2c61f1a66ae1ad55f837feeeb6a7e2b0bf50cee77fd478fb601733459549316bbaa0737c66dcf05023f8497da4
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFAi5bBq9YCp+ud/ME/SMeVevXplWhXDVAqCLRWyTI:gZLolhNVyEv6JsSohlpqCFrqH
TLSH
T1B094D025B281C036D19305318BE6DB36293A7DB15B6264CBB3D8377E1E753D1A63A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5520	B164.tmp

Executes dropped EXE 1 IoCs

pid	Process
5520	B164.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_5cd954a22c47e532f4cb6ade05da10ba_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B164.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5520	B164.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 5520	1372	2026-08-03_5cd954a22c47e532f4cb6ade05da10ba_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_5cd954a22c47e532f4cb6ade05da10ba_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_5cd954a22c47e532f4cb6ade05da10ba_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\B164.tmp
  "C:\Users\Admin\AppData\Local\Temp\B164.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_5cd954a22c47e532f4cb6ade05da10ba_elex_mafia_stealc_tofsee.exe 90B80DDB4FEFCABDA85D39DBB43E093C8E0E7A05839FBB7D17B2685CAE13173A6567D4A91FBDEEF3A17B6210C48A6612D0277AD34838A65E6F88956ADBDA11A6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B164.tmp

Path C:\Users\Admin\AppData\Local\Temp\B164.tmp
Size 411KB
SHA256 81e0ae659bf32deeeb716ffb688b4b70041f9852b1a84c19b94cf0be2cb7351c
MD5 eab8eb49a980c8dd223b019bb1ae94ed
SHA1 6ab1e6b5bb63001414fbdeefd23e6ca8d1c39ca7
SHA512 32ceef1013a365e5c9d4bf8d372d9a2d235064435bc043bc1d24dd87bd1b965d94e90b18b9e9d4baf1880b1721a7a732c69b0ec407c7ee0db602b2908126fe4c
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFxoSFybIOdtbMGQ5z40zJaojqH:gZLolhNVyEYOb9dtbMv4+qH
TLSH
T11394DF25B2C1C032E69701314AF6D776653A7DB15B6264CBB3D43B7E1E702D1AA3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads