4eb3ac9ed39a98eeba2effb43a0993443e01cc0e304b97a19e8f25f3ed774cf3

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_6016af2627db7785d2d57a54e3c1982f_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260811-dnn75seq4w
SHA256 4eb3ac9ed39a98eeba2effb43a0993443e01cc0e304b97a19e8f25f3ed774cf3
MD5 6016af2627db7785d2d57a54e3c1982f
SHA1 cbe233b77129ac5c0a3ef09c5ee2e3a347368b76
SHA512 1bcda6a04e3400a309c1af13aec265ba1f7118219490cc6f93d71f3880a4cd38dae270ade92ddab868c20b2668bd30d10f7de6eeca85b60d915b6a612a39779d
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnGEhpniXcJTdS94G6tJWlmgxJPjerW6hewYP:U6PCrIc9kph5YSnbkKXGIgxEFhpg
TLSH
T10194E0343581C03BE6A305304AEADAA6193E7E754B21A4C73BD46BAE6E713D1E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5068	75A3.tmp

Executes dropped EXE 1 IoCs

pid	Process
5068	75A3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_6016af2627db7785d2d57a54e3c1982f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	75A3.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5068	75A3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 5068	4556	2026-08-11_6016af2627db7785d2d57a54e3c1982f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_6016af2627db7785d2d57a54e3c1982f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_6016af2627db7785d2d57a54e3c1982f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\75A3.tmp
  "C:\Users\Admin\AppData\Local\Temp\75A3.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_6016af2627db7785d2d57a54e3c1982f_elex_mafia_stealc_tofsee.exe 59B695569FCCCB1F8AE269C2C0788E02FBA686EB5701EB1E62DF850DF5EB4C73A1BAC533927589F76A34A301AB4A8BBA6E443936E0CEFA9721877795D46FB873
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

75A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\75A3.tmp
Size 412KB
SHA256 2fb74fe7cda447bc117ad9fe19242873db8bc707af6ded5215e05ee17885b72b
MD5 ce3ee1177fdd7b45214806ea3913736c
SHA1 731af446060a8e4617f6646d2abb88147f3e27c3
SHA512 4227ee6d4e1431c2ada43cb374471a566e4453160b24d91d25938630b20c879c7e56f1cf3e9227fdf64051f26a6d3356cc3a2703ff06c33aed2467e103cd8b3e
SSDEEP 12288:U6PCrIc9kph5hcNI4pKMlP2GIIlwvmpHVzvZDOzz:U6QIcOh5hohpDlPSIlwEDZDc
TLSH
T1CB94E03035C1C036E6A305348AE9DB66293E7D754B6269D72BD46BAE2E703D1EB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads