ec28267f039e45f584ae74b02025538a580dcb7d6b27888ca9ba0913183fab5f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/08/2026, 04:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-13_534e5315cb11b027335f83ea1dca617c_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260813-fl2fssbm9y
SHA256 ec28267f039e45f584ae74b02025538a580dcb7d6b27888ca9ba0913183fab5f
MD5 534e5315cb11b027335f83ea1dca617c
SHA1 abb42ae069e7ed434572a961eb09010dd1f61cae
SHA512 0cd85d3125e55d977b2ce562b6da31088d836569f5fd4ba4b0ef3d75ac8454486f0f8e82ce7dcfddf43db56b45d43a08d25f029eafc2a54e5302f0a8c26b6288
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFLiLtY3sEz/6cqeJBvuCHFlYKi3IHHHcqHR:gZLolhNVyEOzHl/IqHR
TLSH
T1AA94CF2472C1C036E19201314AEAD7B5253A7DA15F6164DBB7D83B7D2FB03D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3308	F008.tmp

Executes dropped EXE 1 IoCs

pid	Process
3308	F008.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-13_534e5315cb11b027335f83ea1dca617c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F008.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3308	F008.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3428 wrote to memory of 3308	3428	2026-08-13_534e5315cb11b027335f83ea1dca617c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-13_534e5315cb11b027335f83ea1dca617c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-13_534e5315cb11b027335f83ea1dca617c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3428
- C:\Users\Admin\AppData\Local\Temp\F008.tmp
  "C:\Users\Admin\AppData\Local\Temp\F008.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-13_534e5315cb11b027335f83ea1dca617c_elex_mafia_stealc_tofsee.exe FC88B25D9A92C1B45E2A07A5769E6EC94F1E7E671A70D492AAC4C42C5CF89FE5C6420788C892265479B280A748710163DBFA3C0992D5E031B16E3021551FF041
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F008.tmp

Path C:\Users\Admin\AppData\Local\Temp\F008.tmp
Size 428KB
SHA256 d8905b777534c6bd67fa988e18cd37a9d7e46deadd8d63cb12836814b8e612b0
MD5 895c23d564b0b5e5b791dd3e7f66b453
SHA1 2d5e299817e544fda107b10f9ecf49295565e556
SHA512 7b1bab37f23b6d40af69430fa2296ad77c675c90e354981fd4d8957d91ac05ef94d84a86321bc73d67ba61b32b5443d574dcd02c384f086759e00cbd30cda82a
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFh7SjKQtovYXvxUm7iUuGRPE++qHR:gZLolhNVyEEWmxvYpize8++qHR
TLSH
T13B94CF25B281C032D09301314AE6D7B2193A7DB15F6164CBB7D83B7D2EB13D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads