3e284a7de8e4e3c204b0805019582cff96d6123f417471c4d91575cbe51c88af

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_8e50006b69a4f514cce9ce8f4b29e4f4_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260804-g35p8axyf1
SHA256 3e284a7de8e4e3c204b0805019582cff96d6123f417471c4d91575cbe51c88af
MD5 8e50006b69a4f514cce9ce8f4b29e4f4
SHA1 f23c5f6bb51c9f969b2f874175b90c3f426b2ed1
SHA512 612ef2ef883ee320db477c19bfbf341d31e24a31e4f36d9dcae76839b4de348d4cdeb338e76490449565492cb2dd77a94777488937143d74edeeb1e42fba8f80
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFOFy1MPhUTHaTCcAigCYvBnx6jLzZ+qHR:gZLolhNVyE3y1deTrPlcp2/YqHR
TLSH
T15194D02972C1C036D1A301314AF6DBB5193A7DA15F6164CBB798376E1EB03D0AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3012	12D2.tmp

Executes dropped EXE 1 IoCs

pid	Process
3012	12D2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_8e50006b69a4f514cce9ce8f4b29e4f4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	12D2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3012	12D2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1312 wrote to memory of 3012	1312	2026-08-04_8e50006b69a4f514cce9ce8f4b29e4f4_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_8e50006b69a4f514cce9ce8f4b29e4f4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_8e50006b69a4f514cce9ce8f4b29e4f4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1312
- C:\Users\Admin\AppData\Local\Temp\12D2.tmp
  "C:\Users\Admin\AppData\Local\Temp\12D2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_8e50006b69a4f514cce9ce8f4b29e4f4_elex_mafia_stealc_tofsee.exe 13E33438A76A693D0C77AA5B41658361AB8ECAE44C8533B325843C05978AC549B9636C3CDB774409A3132E00B6C6ED4B78AD8BE8C1EC8FB2CD250A07614DB779
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

12D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\12D2.tmp
Size 428KB
SHA256 3eeaa9ffb2f2a0b4bb9d81670a36163bed2b72f9cb4ead113ccb041dffa501bc
MD5 33f61af78de0a29aba68812ad1bd932a
SHA1 a099023cf50961b08cf5a56ae1fd84e3196df676
SHA512 11144029f6bdf55d23d56bbbb8bbcfcc282accf8f54cb014126be4861cda8b4887e5fa5edd179a88eab212368aa0f7e333af4c0bb2fcd5d339d9e8e3ef4600cb
SSDEEP 12288:gZLolhNVyE06MM5SGAlie2sYPMi+DkOhMqHR:gZqhOE3MMIGyi+DkOhr
TLSH
T1E994DF25B2C1C032E19301314AFAD6B5153A7DA15F61A5CBB7D8373D2EB03D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads