37258d33e490a47096fee8b83015388c532cb0037e39b3941eec99376c9f4de3

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_e9a318300645cc5db5fa51385c3aa5f8_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260809-fee9zstxhv
SHA256 37258d33e490a47096fee8b83015388c532cb0037e39b3941eec99376c9f4de3
MD5 e9a318300645cc5db5fa51385c3aa5f8
SHA1 6e054bd77322b1d6ed9a05677d926559c9b89d63
SHA512 de801bbcde8418f3d48a19b8fc64ed538ded8677b4cc6d042122425247250f09240ebf13c60559c1d06b23e76a36fdd4b988bd66b26f4ee83d64e6b46ecdc012
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHZqh37hNxrb32xoaSjbeW9aKPsaZ:Zm48gODxbzGN1NFz2xoacb593VZ
TLSH
T1C784DF287581C033D19705354BFAD7621A3B3DB68B2568C77BE47AA99EB03D1A73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4288	744C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4288	744C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_e9a318300645cc5db5fa51385c3aa5f8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	744C.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4288	744C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5936 wrote to memory of 4288	5936	2026-08-09_e9a318300645cc5db5fa51385c3aa5f8_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_e9a318300645cc5db5fa51385c3aa5f8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_e9a318300645cc5db5fa51385c3aa5f8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5936
- C:\Users\Admin\AppData\Local\Temp\744C.tmp
  "C:\Users\Admin\AppData\Local\Temp\744C.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-09_e9a318300645cc5db5fa51385c3aa5f8_elex_mafia_stealc_tofsee.exe 1DFAC8D9D704B3FFCE724F6297EFD19016E34D03E8DFCB0BB6641C5C56A3830446C6CF013809F923D69256F3FC52F0B40B1376067A7240C7DD88155BE58C2467
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

744C.tmp

Path C:\Users\Admin\AppData\Local\Temp\744C.tmp
Size 384KB
SHA256 b293eb5f8db30077a33e3909b521d41f357466e993d75298f68fa1e3f10d6704
MD5 f9ff4ebcef2382261e2849bbb8ae751f
SHA1 fc39070fcaacefbd659bf68a5a2912a282cd44df
SHA512 e5400b49ba7cebb0553148561e5218292dc345f9f386d870492497198ff8eccadf8ff7609fdc1ea177b6ca1782b33ddd5539af828bbed588715c6740fa460ddd
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHe6sBz11Jm+wQ/C/rB8fy+hS2oX5gv/pnTY6jZ:Zm48gODxbzU6sBvJYQ/eNsy+E5gZnTDZ
TLSH
T17084D0247581C033E19701314BE6EB655A3E3DB28B6468C77BE47B6D9EB13C1AB3424B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads