79aa14990a78d4b454978ff8213c09e908cd3dd4615196125dd4a96b27e948c9

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_1246e34f0b23450fc024d68de9e05581_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260811-ed5mtacd25
SHA256 79aa14990a78d4b454978ff8213c09e908cd3dd4615196125dd4a96b27e948c9
MD5 1246e34f0b23450fc024d68de9e05581
SHA1 f6f65fa41250a23e5803e46a643116199e85120a
SHA512 b4186e95ac4f6ac738cce34a74b9385c3cdf291ba4a2d22c268bae1555f1e35453bab780d4c3d29bc4327fa86a268c7bdf9a35707bcbac09d2df0239f65dec69
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFBT7IeLLf5AWwC2y5KaUuF6wR7RVuWMuXqHR:gZLolhNVyEmT7dflC6UuF6wZlzXqHR
TLSH
T1A594CF28B681C036D19301318AF6D6B5153A7CB15F62A4DBB7C8377D1EB03D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
108	6567.tmp

Executes dropped EXE 1 IoCs

pid	Process
108	6567.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_1246e34f0b23450fc024d68de9e05581_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6567.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
108	6567.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 108	3284	2026-08-11_1246e34f0b23450fc024d68de9e05581_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-11_1246e34f0b23450fc024d68de9e05581_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_1246e34f0b23450fc024d68de9e05581_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\6567.tmp
  "C:\Users\Admin\AppData\Local\Temp\6567.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-11_1246e34f0b23450fc024d68de9e05581_elex_mafia_stealc_tofsee.exe 710E78F3C8CCE3F8151200A3B94FAA2CBE4246DE799B7B364929BB1B62AB664E9FD2E10476E220CA19FB369CFC2328162895C0AE3A2B78D29B3E5EB924BC629F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:108

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6567.tmp

Path C:\Users\Admin\AppData\Local\Temp\6567.tmp
Size 428KB
SHA256 c7d0f401b379f224eafde3d5ff1cf36bd4e23bf841ffb1ddaac04e81d5576e9d
MD5 a508b4473d94b0a2115cfd301e18db19
SHA1 526f8c0e081dc6de6ce1d152d33343413cac32f2
SHA512 bb2a6c78386bab42ce815bd46a525bd0e0da29bc1684820edd28a0cbe5ee8c217457e32b503858b917bb02627049635e1f67ddff4afc3af1ccfd4594653f03b8
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFELxjiuyyhRm0jkDjYT7I7hlU6j6uejGFyqHR:gZLolhNVyExxjCyXsksH6S8qHR
TLSH
T1F694DF25B681C032D1A3053186FAD7B6593A7DA15F6160DBB794373E2FB03D19A3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads