a481c7a194ce98fbb78f4ffb611b19a0f2b1c7e4bf4322c927a20c99ad64690c

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 18:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_aa1e40e2b424b80a7204dc2c9823a995_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260804-xjaczaxgke
SHA256 a481c7a194ce98fbb78f4ffb611b19a0f2b1c7e4bf4322c927a20c99ad64690c
MD5 aa1e40e2b424b80a7204dc2c9823a995
SHA1 c0d62cdcb802755df7bb617f7e13f0bcc1dbd7ac
SHA512 ae9017594b46f8010ddbd11a6fcb680816c0fa7cc49d9cdda755e8218278aaa74d85e4bc3865f501f99925a7672c99f7dec4adcbccdc5ec9185ad51cd1d369af
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFgYpOCHEzo3PsTP/FMTVyLKkqHR:gZLolhNVyE2xh3PP41qHR
TLSH
T14D94DF25B2C1C036D09301314AF6D7B2553A7DB15F61A5CBB7D83B6D2EB02D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3592	7DE1.tmp

Executes dropped EXE 1 IoCs

pid	Process
3592	7DE1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_aa1e40e2b424b80a7204dc2c9823a995_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7DE1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3592	7DE1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 3592	2776	2026-08-04_aa1e40e2b424b80a7204dc2c9823a995_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_aa1e40e2b424b80a7204dc2c9823a995_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_aa1e40e2b424b80a7204dc2c9823a995_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\7DE1.tmp
  "C:\Users\Admin\AppData\Local\Temp\7DE1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_aa1e40e2b424b80a7204dc2c9823a995_elex_mafia_stealc_tofsee.exe E65942D898805EB9D202175EF2ECD0A42AB184B984436B94FB3D693957697A57307B42E44C2374E22254A53EDC1F9BB3888772D60A98D79F68A89424E8B3BF02
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7DE1.tmp

Path C:\Users\Admin\AppData\Local\Temp\7DE1.tmp
Size 428KB
SHA256 b59d2e016b1ad04690d0efd547ba8752837844ed609db3c891dac57edacea302
MD5 4eba037173029ce8f3a39d6219d8fc85
SHA1 c98ba7f9eade7ab01cf21a46683020e7406e3aeb
SHA512 7e6c0c8195e02b4ec6df7b467cd95ac83bc49d1c7de71c7f79709536387f286caab03e8f8be9e0100cf00ce700bfa2b61797fed80f159a7ab85de2ef6753522c
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF3QIQpLbuF5qmFpNx76N1snbiCc2vMals6qHR:gZLolhNVyEtIeLbWv77uWbJzqHR
TLSH
T1F594CF25B2C1C032E19301314AE6DBB5193A7DA15F6164DBB7D83B7E1E703D0AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads