39d90b759f88e501865aa7435fa65f57e040478a9e7a7716f9c21fcb0d2f91e4

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 21:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_12653d85f3f19b531f2a05e52e3166d2_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260804-z3dkvaha88
SHA256 39d90b759f88e501865aa7435fa65f57e040478a9e7a7716f9c21fcb0d2f91e4
MD5 12653d85f3f19b531f2a05e52e3166d2
SHA1 4d088bf09466fcaf46cb08fb19a2c5ec428b04f3
SHA512 a6cad6ae210de31ba790b79bbc3943129e7c0a18f7e55fef9919782d53f543baff4448ea255a83c7e69367104f05982079ca9159fec846a35a8bad1e0fda4ece
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF7XzkwfBsa6VOz6RH9kIR0ksQ8JMrjuqHR:gZLolhNVyEe0a6zRHzsQ/3uqHR
TLSH
T1F694D02472C1C036D59301314AE6DBB2253A7DB15F61A4DB77983B7D2EB13D1AA3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4896	51B0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4896	51B0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_12653d85f3f19b531f2a05e52e3166d2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51B0.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4896	51B0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2884 wrote to memory of 4896	2884	2026-08-04_12653d85f3f19b531f2a05e52e3166d2_elex_mafia_stealc_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-08-04_12653d85f3f19b531f2a05e52e3166d2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_12653d85f3f19b531f2a05e52e3166d2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2884
- C:\Users\Admin\AppData\Local\Temp\51B0.tmp
  "C:\Users\Admin\AppData\Local\Temp\51B0.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-04_12653d85f3f19b531f2a05e52e3166d2_elex_mafia_stealc_tofsee.exe 0FB544518153BD88A64BBD6515EB9C30FCA8DCAB20AD92CBFFF723BC185B010D1B71E0B929E5061C8A55C43AC690C2F875A5ED5B588C924B01A3FE1137A91154
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

51B0.tmp

Path C:\Users\Admin\AppData\Local\Temp\51B0.tmp
Size 428KB
SHA256 5836dceea3fb5ca62c2129b487b05d544bc260bccd247114dbe8bd31655b905f
MD5 41e4ae21d1bc1d630455c8479ba6b52b
SHA1 bf7e583b6939880526084ce514248e3540f61e26
SHA512 183a83c6e03e3d63fd8b1403cd34a4fca93143f87a11a969fdb098e8deb4a98b0e580eb3aed1b94040ad63f5fd6c81c60877448e91daea850792c9b4ebb9a03c
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF0jwc16o0x/cqOsy7K8flhgccEJd5fCjp5PkqHR:gZLolhNVyEzkc16fRAVflhg3jp5PkqHR
TLSH
T1D994D024B2C0C036E197113146BAD7B6153A7DB15F61A5CBB7D8376D2EB13D0AA3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads