1422ce7c0895638b41710cfbea1330a852b9a3322a45d93bde90292cf9ae42da

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 20:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_c66aca1780c8c94c381e87a1cb3d05c4_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260815-y8ffysgl2t
SHA256 1422ce7c0895638b41710cfbea1330a852b9a3322a45d93bde90292cf9ae42da
MD5 c66aca1780c8c94c381e87a1cb3d05c4
SHA1 7ad62be1bc8869c0d7378b2abd03f3acf23a6c68
SHA512 80b21f42d6cb2d40f1b28567b7668e6f92cc3bc6c96c1765bccee45824d5953b1017f6a66cb48793963efa17828bfdd3e37bd612f97378669a0a6aa47a6a128c
SSDEEP 12288:gZLolhNVyEHRNlZOfVUIfEnMwDURvgqHI:gZqhOEzrHIfXwDMS
TLSH
T13E94DF29B2C1C032D19700314BFAE776157A7DA15B6164CBB7983B7E2EB03D1667A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1896	578C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1896	578C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_c66aca1780c8c94c381e87a1cb3d05c4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	578C.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1896	578C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2932 wrote to memory of 1896	2932	2026-08-15_c66aca1780c8c94c381e87a1cb3d05c4_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-15_c66aca1780c8c94c381e87a1cb3d05c4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_c66aca1780c8c94c381e87a1cb3d05c4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2932
- C:\Users\Admin\AppData\Local\Temp\578C.tmp
  "C:\Users\Admin\AppData\Local\Temp\578C.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-15_c66aca1780c8c94c381e87a1cb3d05c4_elex_mafia_stealc_tofsee.exe C89DF2D8203C1AC815E55130B9E2EFE3B28426E5DD97DA207298F6A682270B62EE71E8A66A930A6E923F766B63DDFCDB09581B637D547F345440F35F86F83467
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

578C.tmp

Path C:\Users\Admin\AppData\Local\Temp\578C.tmp
Size 411KB
SHA256 187ae570e17f0d6147386655d774e1b418685f4ff092e7482191d9fb4fbe5172
MD5 667899e0660eaec87b7788c81226b7c5
SHA1 e9cf7aa879163bb930366e2f0d11c090adbe1d63
SHA512 1e21e904aad92812dd9842dd53f952a9f3c087eeb23a0a5b1d7899b36479f3340b9b73ba54bdfca6a961cbf1828390028295998d36c166636b7f519b9c5afc9d
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFBNBLPLp91Fazp0CgP8SSbGGku5385JY8XqHI:gZLolhNVyEYf7Lj1sz6+SxG3YqHI
TLSH
T18994CF24B2C1C036E19305318AF6E776193A7DB15B61A4CBB398377E1E703D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads