272c6c1fe1138effd02356508977f6f0d2a4a034b4f23bd81159cf88683bf24d

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 21:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_5136b8d8da71ed266f51df46c6da3bfc_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260805-z4c1psea69
SHA256 272c6c1fe1138effd02356508977f6f0d2a4a034b4f23bd81159cf88683bf24d
MD5 5136b8d8da71ed266f51df46c6da3bfc
SHA1 71ea195016f99e435a236f205b441ca6aa521de1
SHA512 343b308b99e17989cc234755ee7be728766a8bb65e83341c309a34e078b8abdfe53eb3f9b8d4824bfd0fffe223a88f65f2e68881fd46d768e8590e0eaa461f27
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnahJbsWDaORhSLSWiJpBo2wFUBiANIR9sYP:U6PCrIc9kph504WLnOBiJpByU9NZg
TLSH
T1E994E0303681C037E19316348AEADB66193A7D755B22A8D73BD467AE2E703D1EB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4120	5B07.tmp

Executes dropped EXE 1 IoCs

pid	Process
4120	5B07.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_5136b8d8da71ed266f51df46c6da3bfc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5B07.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4120	5B07.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4120	2880	2026-08-05_5136b8d8da71ed266f51df46c6da3bfc_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_5136b8d8da71ed266f51df46c6da3bfc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_5136b8d8da71ed266f51df46c6da3bfc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\5B07.tmp
  "C:\Users\Admin\AppData\Local\Temp\5B07.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-05_5136b8d8da71ed266f51df46c6da3bfc_elex_mafia_stealc_tofsee.exe C8DF2429BD24DB886B34F436C2A6796D2A81E6D740529C91EA61EA73F4CB0961B6563AA0E0CFDC1D368289F3D1813AB4AA84403163D899091E242E2849D9C2A4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5B07.tmp

Path C:\Users\Admin\AppData\Local\Temp\5B07.tmp
Size 412KB
SHA256 7e5ab7823a972b945a97e4cabe37f5405e148e2ed2185ec45ab226063ed01e59
MD5 4f9f4ff66a0082e3f4d7f663c057f7ba
SHA1 e01797f9afc6cb05bf9557a3f252e30ef7eb506c
SHA512 302b2f71552229ca68325a0004872768fd4c09d8cbb6304aff0df297a7300cbd785755aa6932dfa13d73bb210bbcd9db78d9f4ac5eedf45385437aa4bfe9ea59
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn9g1ZD7xXRPuIWLeAJ+o6EosD3zYAeXP:U6PCrIc9kph52ZvxBmIWLeC+o6ExjY
TLSH
T16094E0303582C036E5A705314EE6DB66293A7E749B61A4CB3BD42BAE5E703D1EB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads