b38e50642cebd4eb16ce586577afbf91c53366e7abc867df082f145ded3c749c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 19:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_01aec5ce774c8c7788b401e5689b9d59_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260803-xsc58awfpg
SHA256 b38e50642cebd4eb16ce586577afbf91c53366e7abc867df082f145ded3c749c
MD5 01aec5ce774c8c7788b401e5689b9d59
SHA1 3ba035641a026c522c52671d5536d1c76245aa58
SHA512 a98611f4d93ae4c2de672bb6c356ec3514cb73b1e2f6e219436bf4f9cc1ad70ae2dc93f9b7ba11f777e763e1f7ecfad372f638a7a17ff6ee8b8a740a3a2acdfb
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn3+ey+GZgTt8t/JlmDhMuNyUzWP:U6PCrIc9kph50e+OZ8t/JlmDYUzW
TLSH
T1E594E0343585C137E6D306314AEADBA6293E3D754722A8C73BD06B6E2E702D1AB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4556	A85.tmp

Executes dropped EXE 1 IoCs

pid	Process
4556	A85.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_01aec5ce774c8c7788b401e5689b9d59_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A85.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4556	A85.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5868 wrote to memory of 4556	5868	2026-08-03_01aec5ce774c8c7788b401e5689b9d59_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_01aec5ce774c8c7788b401e5689b9d59_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_01aec5ce774c8c7788b401e5689b9d59_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5868
- C:\Users\Admin\AppData\Local\Temp\A85.tmp
  "C:\Users\Admin\AppData\Local\Temp\A85.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-03_01aec5ce774c8c7788b401e5689b9d59_elex_mafia_stealc_tofsee.exe D1684BB0E6870248A92E6C83DD737EF7457492E6F7AC655764730DCC80D086DC8A97105A9181C1922E09EF4147377B2E1A35B7DB2580E37B8F5502DD53FB6DF0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A85.tmp

Path C:\Users\Admin\AppData\Local\Temp\A85.tmp
Size 412KB
SHA256 45e31346cd003d6a720d80beaf96602f9c284f632eb9b87d44f5c5ac59f187f1
MD5 a12078d2f8dbf34edb93daa1fc69f32d
SHA1 d0bb35656989a3c9132710c51e5d087c71f070de
SHA512 a384f53e004365726aa1279219f850e61dc2f04acb160f1a310675a64049d0734ea8ed1aa70a021da3ecee2e7b901240c25ccf82a6f183621a23e88e0d0950c3
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnv9qZS3rXvvRRCmlvMzM7BviFNSgo5wG9P:U6PCrIc9kph59MM7XRRkwBaFNC5wG1
TLSH
T13994E0343585C03AE1A312358AEACB66593E7D754722A9C73BD46BAD2E343D1DB38307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads