1a4a5d35563996f9fed68d155ee0acb378436a104a3b3538fbba71abf336a508

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-15_72b73ba5630474a0ffb6b968fb7f0550_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260816-db5pcsah73
SHA256 1a4a5d35563996f9fed68d155ee0acb378436a104a3b3538fbba71abf336a508
MD5 72b73ba5630474a0ffb6b968fb7f0550
SHA1 4ebb6d2d8c87c308dae94c97f898482b48a3f7c4
SHA512 af2425b7f032164570456bf2049e22ba7f159087563bd095776ebb526f9ba2dcb73943f15e6f77ec2661c72936465b6558cae39da589fc6d21c630b0768a47c0
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFmvgrChkpxso5GInP3sVqlEztHVMqHR:gZLolhNVyEtvFh4BnPkqlWVMqHR
TLSH
T1E194DF28B2C1C036E593023546AAD7B1153A7DB15F61A4DBB7D8373E2E703D1AA3931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5392	FFB8.tmp

Executes dropped EXE 1 IoCs

pid	Process
5392	FFB8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-15_72b73ba5630474a0ffb6b968fb7f0550_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFB8.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5392	FFB8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3900 wrote to memory of 5392	3900	2026-08-15_72b73ba5630474a0ffb6b968fb7f0550_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-15_72b73ba5630474a0ffb6b968fb7f0550_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-15_72b73ba5630474a0ffb6b968fb7f0550_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3900
- C:\Users\Admin\AppData\Local\Temp\FFB8.tmp
  "C:\Users\Admin\AppData\Local\Temp\FFB8.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-15_72b73ba5630474a0ffb6b968fb7f0550_elex_mafia_stealc_tofsee.exe 48886A953817D9B646FA762A3545FC8F42A5C1ACF1BC384D55951B6F78FA86BDB355DFEC420F3AC338203CFC6A6886AAE053E0373C65B5AAA87A58B2BD6FFAC5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5392

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FFB8.tmp

Path C:\Users\Admin\AppData\Local\Temp\FFB8.tmp
Size 428KB
SHA256 443797bb4b0e14fa6e0698cee4b4b72407a85cb5d644f835936740ab936d0636
MD5 39241a9aaa2ea0c910e4b5120e320040
SHA1 8f00de1645ef6275a634325525a1665ea3fdd16b
SHA512 ecc0f4cf807ffd1671f2fc12545ce6e2fb6fcc22b88bb2dafce58bffd565a395318ef211212259ede2ee8704ccdd1ae5e7250b13a36d2f00858c01eb4cbedf24
SSDEEP 12288:gZLolhNVyErWrTyNZRlvcjUgFtV7NK3+rUmdBqHR:gZqhOE0Tkl0jDRNpUm2
TLSH
T13E94CF24B2C1C036E19305354AB6D7B1543A7DA24F6161DBB7D83B7D1EB03D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads