5ef5a5cf6b97217a57e7f127fd09fc8d8f2ddf3d1b17a62f07a694d21e8d2fcd

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 03:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260808-d53rvsswds
SHA256 5ef5a5cf6b97217a57e7f127fd09fc8d8f2ddf3d1b17a62f07a694d21e8d2fcd
MD5 51f30145836bd4b8b79024a6dc471a96
SHA1 29d55484704bc41d297cce3d0f5bc17be6c7ab3f
SHA512 c8e2be10c97ae2e67e8021181ed450628696f712714b0d943988482e9e457ad62aee1e074661cb41b9ec86514ee3a011d55ed25e600e96d293649ce7d4a16ba8
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnFuylb+0FTaq/Fkqu58CXE3dDxciamiHky6Td0c:U6PCrIc9kph5uylb7daqe8wn6vw2p
TLSH
T1FC94E0347681C036E2D306308AEADB66593A7D755726A8C73BD467AE2E703D1E73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4212	37C0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4212	37C0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37C0.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4212	37C0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4632 wrote to memory of 4212	4632	2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4632
- C:\Users\Admin\AppData\Local\Temp\37C0.tmp
  "C:\Users\Admin\AppData\Local\Temp\37C0.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-08_51f30145836bd4b8b79024a6dc471a96_elex_mafia_stealc_tofsee.exe 30DF75EBA78FAAEDDC7DF70740907DCAA77A58C82AC94E7FB696BF4C3489AA10429C29478EC73DB6A51750CE0C458CE810F337BC3D35121191BFE05DF0973BC4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37C0.tmp

Path C:\Users\Admin\AppData\Local\Temp\37C0.tmp
Size 412KB
SHA256 43aefb7b3b638d78fa77502eb568b668098062f3a44a824600edcbb6e1f57540
MD5 00ef052b5430bce0690cfaab716482ef
SHA1 27eb00f444f3916e51be2a5365be1f1e514e7c91
SHA512 34d8d05098976c861f449c44efbd5f8e98b9966beda1ed156e4b3435824db75cf098dd2ee9498e0a37be842536dd5ba5a3b9f270b9d07d92244f673f1c3a88bb
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnaM7QXrx8Rb/UVmg1qsGmfWK+6sc5wEEEuADP:U6PCrIc9kph5sM+x6UQeqXm66sc5w+T
TLSH
T1EB94DF343681C036E19309358EEADB66193E7E794B22A8C77BD457AE2E712C1E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads