db252b0dce158f810a908adb7b29781464c46145a3047bd21899ea57d05c9b88

Analysis

max time kernel
150s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_25e91b2f5850f4cac823dfc6af449794_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260817-cv736adn51
SHA256 db252b0dce158f810a908adb7b29781464c46145a3047bd21899ea57d05c9b88
MD5 25e91b2f5850f4cac823dfc6af449794
SHA1 e720440d9275a117aad596f549f55cf35e5c1172
SHA512 50fbb3b91c5f2c639f9e0ea647dc39d012e916be7457a471769798e8bb410e6a7dbd11d90409b19e3094d25cee176e41218cbce6ebc02e46c3c905064f9635d7
SSDEEP 6144:dVdvczEb7GUOpYWhNVynE/mF50kzGGJQOOZCEWnJPNq5JF54MPlf1JL9zqHg:dZLolhNVyEmz7lODEJlq5D1PN5qHg
TLSH
T1DA94D028B6C1C036D19705314BB6D776253A3DB15B6164CBB3D83B6D2EB03E1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1692	3109.tmp

Executes dropped EXE 1 IoCs

pid	Process
1692	3109.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_25e91b2f5850f4cac823dfc6af449794_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3109.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1692	3109.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6080 wrote to memory of 1692	6080	2026-08-17_25e91b2f5850f4cac823dfc6af449794_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-17_25e91b2f5850f4cac823dfc6af449794_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_25e91b2f5850f4cac823dfc6af449794_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6080
- C:\Users\Admin\AppData\Local\Temp\3109.tmp
  "C:\Users\Admin\AppData\Local\Temp\3109.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-17_25e91b2f5850f4cac823dfc6af449794_elex_mafia_stealc_tofsee.exe 763837824F6E3F3B3CA4331D956F933CCE8B1B0182ACBB87682E9D0642BD0987683881C8E27BD843465094D478CEA3B9E484D9A997E93E309D91DACE24D4EA08
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3109.tmp

Path C:\Users\Admin\AppData\Local\Temp\3109.tmp
Size 413KB
SHA256 3c2c74a6316ec99df308a80063594a513b1073631b55d6441b13448bf4872800
MD5 625547d17c8fd842d31bc32f21427704
SHA1 76eabaaac09e9c867d5d639b8fa0a87a052be5e9
SHA512 a40ffedf0551c70cb710d5508d6870ea3f36ffc50a36917920abd61a470517f001793271fbedfa28f954bd24b01271672b9f8b3fe960ef7778ea96744bc4e542
SSDEEP 6144:dVdvczEb7GUOpYWhNVynE/mFsHp2ey1VWWSEvyGnaWhR51KSKiVgYTqHg:dZLolhNVyEfIeAXjh4SKwLqHg
TLSH
T10794CF28B2C1C036D59201314BF6D776553A7DB15B61A8CBB7D83B3D1E702E1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads