9eb25d61388d113ce36e40e307e4e482401dfca88aa5c7f950b2a76b0bd6d4e0

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_999e4390fe867e7f01cbc11200aad410_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260804-xtf89scm9v
SHA256 9eb25d61388d113ce36e40e307e4e482401dfca88aa5c7f950b2a76b0bd6d4e0
MD5 999e4390fe867e7f01cbc11200aad410
SHA1 144b2e59bc532542eb4b23be20f02f3358e85110
SHA512 81696c251fa77e2d8c26a035a98b7c3e4ad9348a1b69a0832e9eb112f54bb64995c432670f8aa984802c8cae1774dcfdc81e06a60dc303f1f4da4f435dbd5167
SSDEEP 12288:gZLolhNVyEjWKoDe7/jRXduPW7q6dxJzqHR:gZqhOEjBRXdKKq6dxJu
TLSH
T1A694DF25B281C036E19201304AF6DBB1553A7DB15F71A5DBB798373E1EB03D1AA3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5820	70A2.tmp

Executes dropped EXE 1 IoCs

pid	Process
5820	70A2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_999e4390fe867e7f01cbc11200aad410_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	70A2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5820	70A2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 5820	2996	2026-08-04_999e4390fe867e7f01cbc11200aad410_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_999e4390fe867e7f01cbc11200aad410_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_999e4390fe867e7f01cbc11200aad410_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\70A2.tmp
  "C:\Users\Admin\AppData\Local\Temp\70A2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_999e4390fe867e7f01cbc11200aad410_elex_mafia_stealc_tofsee.exe 3795E406AEF0AB20225D5418EC96EE4D99D3193AE082E775393F8C5BC3FD582EB5F4F0EDAE48E9F00E90D7BFC951054D5FA0154837633D6DAB3A203E4284485A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

70A2.tmp

Path C:\Users\Admin\AppData\Local\Temp\70A2.tmp
Size 428KB
SHA256 ce381131e0346440710b211af9cca76f38bd45ae166e01a68ae67e0cf7ff0303
MD5 d20c1247ebab426a06f74e3311087c33
SHA1 c8d8b8d3cbae26336853a91a3ea13eb6a0c09545
SHA512 dde561da71f38fa0ec5342260dea294c12ba67d91ca5148db457c7e722981da2252d66d22a7213b1ca42b44f475c532e6cd122a8ed004a3eeec0852c22e4ecb8
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFwyktPchaWW+HqQ86m0TDDQv1owY4qHR:gZLolhNVyEUj7H9xT/QvjqHR
TLSH
T13E94D025B6C1C037E59301314AB6D7B1153A7CA15FB1A0DBB798377E1EB02D1AA3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads