635fff966f41d0070ea2cd112c65a352b591a47f957eee0cd6eebc3553e89d72

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 14:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_328bbfa0cc3bf1ce3cc69b64737d74a3_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260809-rz96msgn51
SHA256 635fff966f41d0070ea2cd112c65a352b591a47f957eee0cd6eebc3553e89d72
MD5 328bbfa0cc3bf1ce3cc69b64737d74a3
SHA1 ecbec557b65cf84ed493e90a5bedce30a49a0fff
SHA512 363524c67f8fae063ca3995243d089064ddebd4e6a12d0bc18c9c50edd08c3670de48ec62a3c8c4db5562a7f53812765166e915afa3f8190efb2c5d6b887ba9a
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFvq6WFeiJuOFKhc0GajwQnLYwq43qHI:gZLolhNVyEKWFei10Gaj3LYwzqHI
TLSH
T17494CF28B6C1C036D59200314AF6E775193A7DB15B61A4CBB7D83B3E2E713D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2316	E337.tmp

Executes dropped EXE 1 IoCs

pid	Process
2316	E337.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_328bbfa0cc3bf1ce3cc69b64737d74a3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E337.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2316	E337.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 2316	4380	2026-08-09_328bbfa0cc3bf1ce3cc69b64737d74a3_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_328bbfa0cc3bf1ce3cc69b64737d74a3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_328bbfa0cc3bf1ce3cc69b64737d74a3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\E337.tmp
  "C:\Users\Admin\AppData\Local\Temp\E337.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-09_328bbfa0cc3bf1ce3cc69b64737d74a3_elex_mafia_stealc_tofsee.exe 41CC279D49868F455D7AAA1516333CDEBA525AF1F3DAD17B5A5F4621F0AA196F153A93BE09A76F3782F8501C428BDF7040BFB65B542DAF1197E02F403ECFA604
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E337.tmp

Path C:\Users\Admin\AppData\Local\Temp\E337.tmp
Size 411KB
SHA256 169b0c1e2024f6efd0c44ba5af687ba9e80300de93b6f076355399f634200348
MD5 ea872aba88f0d452c9e546fcc85d5795
SHA1 e5c8f1cd2a325bafb66e233be9cd5bffb4d53a27
SHA512 9c4a6a868825cd4f206b7709d12ec67981d8fa19240000e8117b79e91e06c0ca5a5e249a13db96927358fd335f82428b14cd8ea02074812f497e0d6634598444
SSDEEP 12288:gZLolhNVyEE9MtYZoB17CSRFLnvzzWXqHI:gZqhOE8MQoB17lva7
TLSH
T14E94DF24B681C036E59301318BEAD775153A7DB11B2268CBB7D83B7E1E703D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads