ff263a78a1c260eda04271f7c58d6ffb2c718743225d4baee3fb7ebcf0c3341b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 17:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_bb754b8c3b0116cbcda0dfeb53373fb5_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260805-v6evvsxycs
SHA256 ff263a78a1c260eda04271f7c58d6ffb2c718743225d4baee3fb7ebcf0c3341b
MD5 bb754b8c3b0116cbcda0dfeb53373fb5
SHA1 700b4ec9fb30ccf8b9ceb12bd835c15eb7d69c33
SHA512 6f0b1d12c9d767e8d306d416154e0bb32fb380229d8397ed59c2a56071901aaaa08db00b9163e0942545c547b11cac82b8210f5851c1b0cd168b030153f8c6fe
SSDEEP 12288:dZLolhNVyEhJci0Uy6A6JUTYMEUXoLZgqHg:dZqhOEzb0eUTHo1i
TLSH
T1CF94CF25B2C1C036D59301314AF6DB76153A7DB15B61A4CBB3D83B2E2EB02D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4236	3DDA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4236	3DDA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_bb754b8c3b0116cbcda0dfeb53373fb5_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3DDA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4236	3DDA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 4236	5068	2026-08-05_bb754b8c3b0116cbcda0dfeb53373fb5_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_bb754b8c3b0116cbcda0dfeb53373fb5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_bb754b8c3b0116cbcda0dfeb53373fb5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\3DDA.tmp
  "C:\Users\Admin\AppData\Local\Temp\3DDA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-05_bb754b8c3b0116cbcda0dfeb53373fb5_elex_mafia_stealc_tofsee.exe 60AFA3C75B6411059AF97A28B06FE065A51025808AD84C63359020537C34B27A43A17E5E6A96015911C6B76E41F10654187008457CDEAC2E5243A58F56589CA6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3DDA.tmp

Path C:\Users\Admin\AppData\Local\Temp\3DDA.tmp
Size 413KB
SHA256 2833d9ab92a4177c57753c360474fb8a7f4d2b355a1ce4c2e97a687c17a0efac
MD5 f83dbb756ac2338e58e6711b5585fdaf
SHA1 de6c177f08bdaf79f41a590028e2267f8a1c0ab7
SHA512 db5c32ecdf4577a23d97d47cb95e38fb20cde61a2dafc4c50a5537b19439e6fc664462d8495e0d803380b30c5846ba0330ea4caeb903bd7def03d7996b32b50d
SSDEEP 12288:dZLolhNVyEvMbWXVzMMvGsXPn2v24w+qHg:dZqhOEvM6XVzf2+4F
TLSH
T12994DF28B6C1C036D59301314AB6E736193A7DB28B6164CBB7D83B7E1E743D1A67930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads