0a74cf60e0dc3e7412547d79dbc82ed29a454ae33ffb474ad055607db5d7388d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_a5c49713643419e6ed3c6b7f943a6b33_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260804-gp8vqasdnf
SHA256 0a74cf60e0dc3e7412547d79dbc82ed29a454ae33ffb474ad055607db5d7388d
MD5 a5c49713643419e6ed3c6b7f943a6b33
SHA1 2ad6adbee5f2f67753d843bc9de982f48ed0ff46
SHA512 1f96470a854e76e3330cd32c7f9072e52380b584a79e060a51c1ad8e991946dfa94204691a80aabf634df046022c4f5dcf583e54ff728a70e0f5b8f8de81158a
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn2rTkKeLA8Dlg9CUOO90ywlWQTBdP:U6PCrIc9kph5ArSDlSCUOo0ycdL
TLSH
T16694E0203585C037E19305358AEACBA6293E3D725B62A8C77BD467AD6E713D1E738307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5616	D184.tmp

Executes dropped EXE 1 IoCs

pid	Process
5616	D184.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_a5c49713643419e6ed3c6b7f943a6b33_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D184.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5616	D184.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3480 wrote to memory of 5616	3480	2026-08-04_a5c49713643419e6ed3c6b7f943a6b33_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-04_a5c49713643419e6ed3c6b7f943a6b33_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_a5c49713643419e6ed3c6b7f943a6b33_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3480
- C:\Users\Admin\AppData\Local\Temp\D184.tmp
  "C:\Users\Admin\AppData\Local\Temp\D184.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_a5c49713643419e6ed3c6b7f943a6b33_elex_mafia_stealc_tofsee.exe AE5660B978114AF270612650993E654E7A30EE80BBD4BE6F229B787925BA1E32A5A3576D9C5EE39CAF10BAACFF692FB452788C9A7466716E38002BACDC08D1BB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D184.tmp

Path C:\Users\Admin\AppData\Local\Temp\D184.tmp
Size 412KB
SHA256 0edf81020f286ef5f8b890f1d26dc4cea79829234ae1c9c34cd43050ba523b7b
MD5 02825f3faaedbbb64b0e935e9f7f7715
SHA1 a749d7f50b504da4419d89056a7254718fbf9d18
SHA512 59d865bc99320de2931f46d4d80c67e09d49ad1bd0ab7cd839226ba5e2d93069eece3cefc4b78c9bc1741b5a69253ace2414f61936cd62e380148dfea1e8b255
SSDEEP 12288:U6PCrIc9kph50pZsuMUugK62a72odi9jIe:U6QIcOh507ssKnkTCjI
TLSH
T1BC94E1343680C036E2A312318ADADB67193E7D758B61A9C73BD46BAE6E702D1D774313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads