ae718d1ca83ac2ac0b4cbba109a76eb9d8db824aff86082e0944154a6f731c74

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 02:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_8afd0cc8c2f5f8e16e2aeabeff2eed06_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260811-dasy6sem61
SHA256 ae718d1ca83ac2ac0b4cbba109a76eb9d8db824aff86082e0944154a6f731c74
MD5 8afd0cc8c2f5f8e16e2aeabeff2eed06
SHA1 825c3738e8608f2a713fa96de227adfeb3824dd8
SHA512 9e0fb35cf461fd803919df22e18987a05a7b403dcd6359e959e3842cbca19a44e1759bf5c31208a3d16a2c484b3330b86532d47beb9c83087a1eff96ea830f04
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF6iEfN4/aSiBcWncqvfdBq1hFCYqHI:gZLolhNVyE9icC/zGcWn3fLq1hFCYqHI
TLSH
T13594DF24B281C032D1A301314BB2D77A593A7DA15B61A4DBB3943B7E1F753D1AB3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1260	B83F.tmp

Executes dropped EXE 1 IoCs

pid	Process
1260	B83F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_8afd0cc8c2f5f8e16e2aeabeff2eed06_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B83F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1260	B83F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5604 wrote to memory of 1260	5604	2026-08-11_8afd0cc8c2f5f8e16e2aeabeff2eed06_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_8afd0cc8c2f5f8e16e2aeabeff2eed06_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_8afd0cc8c2f5f8e16e2aeabeff2eed06_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5604
- C:\Users\Admin\AppData\Local\Temp\B83F.tmp
  "C:\Users\Admin\AppData\Local\Temp\B83F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_8afd0cc8c2f5f8e16e2aeabeff2eed06_elex_mafia_stealc_tofsee.exe 72E7BEB6045B145EBEADC5220D44029B60380AA0EF7F5828D306B337D63CABCAE0A74E0C5A03553F3E3ADB03659E7FB8E616252DB1E21397EEBFD4A62413A341
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1260

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B83F.tmp

Path C:\Users\Admin\AppData\Local\Temp\B83F.tmp
Size 411KB
SHA256 4e098571da747689809f9d1d7b41f30f0630c4f31a8959f53c3880c17ab2df75
MD5 fe2416ece953a86a935f4364cbec11bc
SHA1 307093f5579ba46b35baff8b02ff76e7212fadb1
SHA512 ae61da365f69ef36a84e369d64ca5c4f4196a4dde1c603d961772b82464946360ca7dfa9ed87308b1ea1e469c20c2c223b698ee6f6919b6c41c58b26407277d6
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFZtx8OeLJtp2LgFbGlT2aQDqHI:gZLolhNVyE2tx8OoaeqBoqHI
TLSH
T15394D0247681C036D19301318BE6DB76253A7DB15B6164CBB3D83B3D1EB43D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads