d239d66d20dfaa6633f5cac2d94fdeeec57ec33d8b11f529cec739d8e476f30c

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 23:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_03a7849beb13b6a864e792773e7c23e3_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260810-211nps1bnf
SHA256 d239d66d20dfaa6633f5cac2d94fdeeec57ec33d8b11f529cec739d8e476f30c
MD5 03a7849beb13b6a864e792773e7c23e3
SHA1 ac8ef3c37d726985a4c31e1ce403e6f693a2e4a0
SHA512 71a784febd3ad512965d825bf6d631acd572b4be4aba379fa9b4f38b5fe04b70984bb347c64055e8dc9c3c31b0cf1c87faa718f24ee86eb9afa393c58743487b
SSDEEP 12288:U6PCrIc9kph5Ly90fPc80LrCuv0IPfZPoSWU8c:U6QIcOh5Ly9Kt2PsIJwSWU
TLSH
T13994D0207681C037E2A302318AEADB66693E3E714722A9C777D467BE1E752D1E734343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3464	577D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3464	577D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_03a7849beb13b6a864e792773e7c23e3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	577D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3464	577D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 3464	2300	2026-08-10_03a7849beb13b6a864e792773e7c23e3_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-10_03a7849beb13b6a864e792773e7c23e3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_03a7849beb13b6a864e792773e7c23e3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\577D.tmp
  "C:\Users\Admin\AppData\Local\Temp\577D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-10_03a7849beb13b6a864e792773e7c23e3_elex_mafia_stealc_tofsee.exe 1A23F1DDC286EF3A4DA3A7BEDEDD2FD14C701FC7439BB1170FD03638ACF780EC42D86EB45B17327A9D78C23148929280A468BBE47A07D3F767B88654CFCD00E1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

577D.tmp

Path C:\Users\Admin\AppData\Local\Temp\577D.tmp
Size 412KB
SHA256 09a59f5954407bfee19eebcb739345a57075722271791a602e3bafa189e3086d
MD5 6a1f3b318af1b80b844e51d74fd30c22
SHA1 244a33904fee56ce38d2858d20c9a2536765dfd6
SHA512 dbe6e0018a5042f8ff8399baea6177330b10bf781a59a2fef85e702095589952209e28fd20a465700961b9e22a961f58e1f08d09dda2bb0bdb63f54c2d37492d
SSDEEP 12288:U6PCrIc9kph5KNwqiyiVtPzzHS4eZXzxB2NbxFI:U6QIcOh5ywnyuzDS4etc
TLSH
T14994E0343582C036E2D306358AFADB62193A7D755B22A8D377D467AE2E702C2E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads