d15a8779e283fbbe4e84c254fa0f77bad71d7330bdc7914e2642e0a38e1d0919

Analysis

max time kernel
150s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 19:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_1c1b41e18531fd83015de1facf764ad1_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260805-xtgvssem8z
SHA256 d15a8779e283fbbe4e84c254fa0f77bad71d7330bdc7914e2642e0a38e1d0919
MD5 1c1b41e18531fd83015de1facf764ad1
SHA1 6b1de170048bc186c74101535f5fbf6d9e65f79a
SHA512 f362c5c74f941ff5a688a0caf39fa89a3dbdc397cb4fe39ae5d2a276315cee5e9141d147a81dd5d91d122b336dae18be70c93d17fcdcf38d6f6b7ec20840dd24
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF+ozc2ghIcMdggMHRnzQJ8MGiXXPqHI:gZLolhNVyEK1cMCzQjGiPqHI
TLSH
T1F594DF29B2C1C036D19301318BE6D772197A7DB54B62A4CBB3D83B6D1E703E1A67931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4604	EBC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4604	EBC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EBC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_1c1b41e18531fd83015de1facf764ad1_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4604	EBC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1772 wrote to memory of 4604	1772	2026-08-05_1c1b41e18531fd83015de1facf764ad1_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_1c1b41e18531fd83015de1facf764ad1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_1c1b41e18531fd83015de1facf764ad1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1772
- C:\Users\Admin\AppData\Local\Temp\EBC.tmp
  "C:\Users\Admin\AppData\Local\Temp\EBC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-05_1c1b41e18531fd83015de1facf764ad1_elex_mafia_stealc_tofsee.exe 043254297BF8C6A4C11589BA8CFFC73D8F2AE04AB96855DB37D581CDA368831E73AB0D80E6FABE6918C1291547E51917AD721A61B260257B409C59D41E4671BE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EBC.tmp

Path C:\Users\Admin\AppData\Local\Temp\EBC.tmp
Size 411KB
SHA256 9b15d023a654dd050989f1ffebec5afbcad1ac2f79c6159aa4510c4d51a49634
MD5 dc7e96d7040c26def36e26b85c9275b3
SHA1 349fbe5f51af7f49575ce31bc6f58adc738208cc
SHA512 72d0ba3cd9c19e99f23042aa06ac4c65b22f67a57c082e8cbd899661af8ecaf352c5f2bc837b1e655fc7af9a26b8c6d6c883043fc2e89ebdb6296ce2b82b9801
SSDEEP 12288:gZLolhNVyEdZfBJH6FdFmEyfE230eL4qHI:gZqhOEja/sEe301
TLSH
T16D94DF257681C036D19200314BFAEB76193A7DB15B61A4CBB3D83B7E1E703D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads