Analysis
- max time kernel
150s - max time network
145s - platform
windows11-ltsc_2024_x64 - resource
win11ltsc2024-20260709-en - resource tags
- submitted
09/08/2026, 16:15
General
- Target 2026-08-09_a62dce5914f424ad6e6f4e623968cc62_elex_mafia_stealc_tofsee.exe
- Size 448KB
- Sample260809-tp8k6shq5v
- SHA256 fafb6ffc2c3ab43acd87689d9f0c264ab3e8ca47688b222773dab7b7ba56b720
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-08-09_a62dce5914f424ad6e6f4e623968cc62_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-08-09_a62dce5914f424ad6e6f4e623968cc62_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5A5B.tmp"C:\Users\Admin\AppData\Local\Temp\5A5B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-09_a62dce5914f424ad6e6f4e623968cc62_elex_mafia_stealc_tofsee.exe E1766203B40CA224D1702A06D79F55C64E786FF46D6949548D45C836DAB69119231E854113EF2836B5A64BB256A264BB4636BE7959C94AC099B1422BB851825D2⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
5A5B.tmp
memory/2300-0-0x0000000000420000-0x0000000000499000-memory.dmp
memory/2300-6-0x0000000000420000-0x0000000000499000-memory.dmp
memory/5312-5-0x0000000000F40000-0x0000000000FB9000-memory.dmp
memory/5312-8-0x0000000000F40000-0x0000000000FB9000-memory.dmp