839a34247f02293ed7f0967678e432c3de0684cc752f5763089cc52610b0f592

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 16:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260810-tv2d2ssgmc
SHA256 839a34247f02293ed7f0967678e432c3de0684cc752f5763089cc52610b0f592
MD5 5cd1ebae9749d7d94a6cfb2065edaf7c
SHA1 090a953356c8324c955406dcb92363c69cbcd689
SHA512 2d41a8f58719ecd2164ec1ce233f15eb9c96e3adb55eaeebd71fd03ad7e8212c441cb78bd32b4a1fda5376a5bd42bcee5967a492d8c71315196bff1446e273d8
SSDEEP 12288:si4g+yU+0pAiv+E2OVJ/L2cBicZu22cyRyeUIkrT/zrNAuxUlvjosTdcG93Dn:si4gXn0pD+E52cAcZxiRjuT/zhylvjRZ
TLSH
T19AC401213581C037E2A715344BE9CBA5667A3DB64722A4CF3BC46A7D6EB03D2E635307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
5500	BE35.tmp
4600	2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BE35.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
5500	BE35.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 5500	2100	2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe	88
PID 5500 wrote to memory of 4600	5500	BE35.tmp	89

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\BE35.tmp
  "C:\Users\Admin\AppData\Local\Temp\BE35.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe F0AA29F8DF77E2BB7EE7CE7AF7B58365E01CF263982BC8E74974DC5DD38EC28F7324B1BFA54EA350E633493302C2E6365FCA5271AE5AC8757ED5D0D5F415004C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:5500
- - C:\Users\Admin\AppData\Local\Temp\2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-08-10_5cd1ebae9749d7d94a6cfb2065edaf7c_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

BE35.tmp

Path C:\Users\Admin\AppData\Local\Temp\BE35.tmp
Size 535KB
SHA256 1c76a78dd75f0ef07e7339783a0b9f16f0c10ab5fc6de5f2a8fa762f8524b811
MD5 be8ff978382546efb7efdef4a7730009
SHA1 4158c698662cf903351e4d142f7233cca965a1bd
SHA512 ed819a6917486e1b06b956be9c53e7c12bf6b9d6070bb2c9cece5a53debd78665712be9101e66be1da634d374f6c71e87c68a857d48e54d64ec00bb79b02ece8
SSDEEP 12288:si4g+yU+0pAiv+mc03igLsuC5s499lllRm/c6IIntaWxUlvjosTdcG93Dn:si4gXn0pD+mdWuJ49RJ6IIn4plvjRhFJ
TLSH
T139C401203582C033E6A715314BE9DBA56A7E79B64722A8CB37C42B6D2E703D2D735347
MD5 SHA1 SHA512 SSDEEP TLSH