8f1ed3274a6ed2728c44f5ec9d629f3aa5f5430a4fdfc1742f02003c16185ea5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_4df21458443e997abfb52577be9b1bdb_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260811-dsrh3avbre
SHA256 8f1ed3274a6ed2728c44f5ec9d629f3aa5f5430a4fdfc1742f02003c16185ea5
MD5 4df21458443e997abfb52577be9b1bdb
SHA1 7641fa9f14ad0f2f0d297080bc348a1ca460dab9
SHA512 78fc4913303be5ae4d28fdc652bec95e42464ca8a0006b2da58789b678167a644add6fd841bc7d8bf5b499d6c4ca8957cac8476d1f0f6f12fed19d5aa00e2fc2
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF26i8oH6OyZ+kSnXBMYrbdQ4ZLqHI:gZLolhNVyEloOy8kSn7bdZZqHI
TLSH
T1EF94DF28B281C036D19301318BF6D775193A7DB15B21A4DBB398777E1EB03E1AA7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2504	5133.tmp

Executes dropped EXE 1 IoCs

pid	Process
2504	5133.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_4df21458443e997abfb52577be9b1bdb_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5133.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2504	5133.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 856 wrote to memory of 2504	856	2026-08-11_4df21458443e997abfb52577be9b1bdb_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_4df21458443e997abfb52577be9b1bdb_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_4df21458443e997abfb52577be9b1bdb_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:856
- C:\Users\Admin\AppData\Local\Temp\5133.tmp
  "C:\Users\Admin\AppData\Local\Temp\5133.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_4df21458443e997abfb52577be9b1bdb_elex_mafia_stealc_tofsee.exe 733AC24E4446F7DBEE568BD1F153CB6C5F1E11896B49D472FA05E1C9534EC153F9EB573F8C1A81D1E3E37939785762E65D8140C74876D9AABF000370A52E381D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5133.tmp

Path C:\Users\Admin\AppData\Local\Temp\5133.tmp
Size 411KB
SHA256 da27f2b31a1b888a893ec60fa04a8a7cfe4bdf914a9ced127221330c7ce1bf0d
MD5 546d48f5a23c0be392dca2037b748ec2
SHA1 1ea5fedeee26a882e37febd17d39e7c04432ebdc
SHA512 c85e016c86860ba6cb1a59a8a8ed6cf1a4b6d48affef5101d7d992c178fa1b12030953685fb6e75a6571f3c4647fc8bc94172a92955d31767595d538e9ed9648
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFxf3++ierU/+925rid9rchWVTqHI:gZLolhNVyEuLrX9bqHI
TLSH
T1DB94DF24B2C1C036D59300314BEADB76293A7DA14B6264CBB7D4377D2E713E1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads