c3a593736605bf837f702c6a8f22b164ecc6d16a810a21afd2679c2ae640bef4

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_be41a193ff8a785fe94504bb63519e68_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260804-ga6f2sgn7t
SHA256 c3a593736605bf837f702c6a8f22b164ecc6d16a810a21afd2679c2ae640bef4
MD5 be41a193ff8a785fe94504bb63519e68
SHA1 2d1901bc3faab0aa1304a4316d41c72c01a5e966
SHA512 e53750ec69ac1079ab3ea38da0f2b814d10d17bed63521c52a67d109f1018350b63be3c886a1c7066ac71078f227ea262587c1a47130a14609c7b3b695b7e2d1
SSDEEP 12288:U6PCrIc9kph5MdQ58wOUtAEzpaD9NWSVHu:U6QIcOh5plRtfpWWSV
TLSH
T18E94D0243681C037E29206348AE5DB66593E7E754B3268D73BD4ABBE2E703D1A735307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5520	4378.tmp

Executes dropped EXE 1 IoCs

pid	Process
5520	4378.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4378.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_be41a193ff8a785fe94504bb63519e68_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5520	4378.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5856 wrote to memory of 5520	5856	2026-08-04_be41a193ff8a785fe94504bb63519e68_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_be41a193ff8a785fe94504bb63519e68_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_be41a193ff8a785fe94504bb63519e68_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5856
- C:\Users\Admin\AppData\Local\Temp\4378.tmp
  "C:\Users\Admin\AppData\Local\Temp\4378.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_be41a193ff8a785fe94504bb63519e68_elex_mafia_stealc_tofsee.exe D67B085C2F232DB2C661492F819D6781AD9060F35BEF2A982DDCA23BABCB30FF5B55F0A301E7B7CD789FE6307CDFBF35A865AD07FA0EFBCF0A29E3644BE134C9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4378.tmp

Path C:\Users\Admin\AppData\Local\Temp\4378.tmp
Size 412KB
SHA256 98f7d17258b3dc11462da545fe8374f0243ee11f5456d33680db7daa2dcf24ee
MD5 9a68d1b406b59f5f5dbac321a996b997
SHA1 5e0d39ce81e2a5286ed04a27d2a1530d8a2830f1
SHA512 90b423cf71775318ff8972e6c22ea20983ffe69d48e321dd092fbc2d300f41de0ada96e869445464fb0ee0732fafc476e3e8b357fad3816c4c86a0eb7268a30e
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnVidsK86Y/ifbZJLG4L2peJQmO++ZJtzP:U6PCrIc9kph5/ids+zZJLGa20RO++l
TLSH
T19194E0343581C036E69316355AEADB62693E7D758B21A8C737C05BAE2E703D0E739317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads