2416b9407ad4e26cbfd123823e4a513544ed7580f102490031e9ec602a3962e4

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_08f346980d6c2d345ca91d7a685c1e01_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260805-rrpvqstzhy
SHA256 2416b9407ad4e26cbfd123823e4a513544ed7580f102490031e9ec602a3962e4
MD5 08f346980d6c2d345ca91d7a685c1e01
SHA1 a284fe2da6180aba3da8f85c3e0aa83237ca7fa9
SHA512 88eb7a7b347a8b73d63a5d132c288500a3c113fb91866ebe73a1ee6216998af6dc7788684884906169a04943a3d382466db3ab62ed8eafa34905992f222d2f7b
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF+8H5XbP8OqwJgA9sZt0Z1z2uE3rgFqHR:gZLolhNVyE85XFqwJgAG30HquYMFqHR
TLSH
T1AC94CF24B2C1C036D59301314AFAD7B5553A7DA25F61A5CBB3D8372D2EB03D1AA3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5388	27F1.tmp

Executes dropped EXE 1 IoCs

pid	Process
5388	27F1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_08f346980d6c2d345ca91d7a685c1e01_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	27F1.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5388	27F1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1504 wrote to memory of 5388	1504	2026-08-05_08f346980d6c2d345ca91d7a685c1e01_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_08f346980d6c2d345ca91d7a685c1e01_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_08f346980d6c2d345ca91d7a685c1e01_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1504
- C:\Users\Admin\AppData\Local\Temp\27F1.tmp
  "C:\Users\Admin\AppData\Local\Temp\27F1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-05_08f346980d6c2d345ca91d7a685c1e01_elex_mafia_stealc_tofsee.exe F7CFD129D7B5BD9BF62CFA9A50EC42CAD84E35F831EAD064E40E2A6E6BAF1171648B123804B804D929AA83BF3C125725BAC013767269A5B9C752139D07264F3C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

27F1.tmp

Path C:\Users\Admin\AppData\Local\Temp\27F1.tmp
Size 428KB
SHA256 b456b0140218f7771232a2d1f8432ffc516547d6c4f4d111d1ba82e0f30f2e38
MD5 65cc7ea7e081ceff064ca4840721e876
SHA1 bd991034eda7020e99e8b42d300a86d4f2096b4f
SHA512 daccc9fdde1a1cd52df7ce6a2d71bbc59b339d15b842d57d9ab25867d08c4fc5a3bf9435c6638c7133fc89e4bffd4cf80197115074d8ae574909d38ff23d674b
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFtsuUisceq/Gq/cTFUp7KpceyGqHR:gZLolhNVyEjt+eqEOp7K+eyGqHR
TLSH
T12494DF24B2C1C036D19301354AF6D7B6153E7CA19F61A4CBB394377E2EB02D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads