70f3b9e985e2c4c0605751808b4d8d74cc8320db29ba7ba1573883620c57b9c8

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 07:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_06f9a9332ab4f0ba7c387fe736baaa1b_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260809-hwsmrawxd1
SHA256 70f3b9e985e2c4c0605751808b4d8d74cc8320db29ba7ba1573883620c57b9c8
MD5 06f9a9332ab4f0ba7c387fe736baaa1b
SHA1 7e6122f32b5e56bba4c828c8e397695b7fb73a99
SHA512 63cb28540ea238ea40ba71abe6afa21286599b5524e847b3f3060bb81b4ece76c29cc27a45309c9309882912c17691b9aa8309e002381e8b0258583c9ade0148
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFuHr2VLooY49WriiV7YG1UfQpit8riqHR:gZLolhNVyEBTB4OJV05fQpitGiqHR
TLSH
T1D294DF28B2C1C036D19301314AB6D7B5253A7DB15F6064DBB798377D2EB03D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4108	5BD2.tmp

Executes dropped EXE 1 IoCs

pid	Process
4108	5BD2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_06f9a9332ab4f0ba7c387fe736baaa1b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5BD2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4108	5BD2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4108	1240	2026-08-09_06f9a9332ab4f0ba7c387fe736baaa1b_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_06f9a9332ab4f0ba7c387fe736baaa1b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_06f9a9332ab4f0ba7c387fe736baaa1b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\5BD2.tmp
  "C:\Users\Admin\AppData\Local\Temp\5BD2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-09_06f9a9332ab4f0ba7c387fe736baaa1b_elex_mafia_stealc_tofsee.exe 2503BE3614658729F18454FE530E1DB7359B079E7EFF8148F63AC54B6841843279CD763E50FBCF945B3E9D67FFF7B203138A9E5CC081DBED3322D353148990AB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5BD2.tmp

Path C:\Users\Admin\AppData\Local\Temp\5BD2.tmp
Size 428KB
SHA256 b3637bdb9cf27c78a9eb4d90e98016c9d7dec9acbdc695b21ab09a1b676f4a48
MD5 da8563b00099dba8417d88a5f646e83b
SHA1 054908b42ca1949efc3ae1693ba47c399e27fed4
SHA512 e145313bd86be040beb74d5cb736e61d39ecdc918f7b104697fc319ef901964e6bcc962193e27a2fd09eecfd4bab0b1b7edd7a510abf0bc57e7142a8582264d8
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFvHqUSbWNFHoGDaQh3l5BWwPBKmqHR:gZLolhNVyEnVO+CpPYmqHR
TLSH
T1EC94D02472C1C032D1A302314AF6DBB5653A7DA15F6164CB77D8372E2EB43D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads