e5109b725827b87b2e2dcf67c7ac3d8b45ce743f7cabf376569f0ec2a38cdcf7

Analysis

max time kernel
150s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_caec596fac82eba08578dc4761a57f11_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260804-wsvjtsbm5t
SHA256 e5109b725827b87b2e2dcf67c7ac3d8b45ce743f7cabf376569f0ec2a38cdcf7
MD5 caec596fac82eba08578dc4761a57f11
SHA1 f6644e1ddce0bbc062794eb666fca394f8551211
SHA512 a0447c19d52b77999759641f131a804b379292044ca81c0a3e6e545a648ab3583881ddbe3837d11bbf3df19066d9c7410607fc233b7c91a5596e6864f2d503f0
SSDEEP 12288:gZLolhNVyEQ6F4K25hV9uRgaW3c08bwLrDIKqH:gZqhOEQ7hVK6cb+U
TLSH
T12294DF24B281C036D19301354BF6EB76153A7DB15B6264CBB3983B7E1EB03D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3896	8B4E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3896	8B4E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_caec596fac82eba08578dc4761a57f11_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B4E.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3896	8B4E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 3896	4592	2026-08-04_caec596fac82eba08578dc4761a57f11_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-04_caec596fac82eba08578dc4761a57f11_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_caec596fac82eba08578dc4761a57f11_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\8B4E.tmp
  "C:\Users\Admin\AppData\Local\Temp\8B4E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_caec596fac82eba08578dc4761a57f11_elex_mafia_stealc_tofsee.exe D2AAF03118B86AD9C892C69500F329235C808169CD0B067C20147AA088909DA3ED9E65E0B08177DD470654084F8DA1A494B24BF10CCAFA099F46F6C9A89BF4BD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B4E.tmp

Path C:\Users\Admin\AppData\Local\Temp\8B4E.tmp
Size 411KB
SHA256 330fd7c144eb682f0ee7d735e6ab92f344960e9b6b9a9169f34dbc37abf8ee53
MD5 6a379523b9b3ae129280db197000d11c
SHA1 ff31fd600dad3bdc6e4aba6219441e3cda768639
SHA512 928d4ca8a6e8cc9bcc5eae9d20b6de57731d102c0ff277978d58fb37d9cb807d306020e50a7a5f862b66943f1e93d918b81995b361562fe912aa18fb84e63248
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFQUomF0+R+7umbELUd6Qrs1ecP+cOw5qH:gZLolhNVyEEoSK74Ufrs0OBn5qH
TLSH
T1AF94CF287281C036D19301354BF69B71653A7DB15B6264CBB7D83B7E1EB03E1AA7930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads