fe05ad73985262906257320750855554cc8781112f01f3e14eef17e21936bea7

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_de6501645d638e7433e8c0a4782ba771_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260817-sam59asfkb
SHA256 fe05ad73985262906257320750855554cc8781112f01f3e14eef17e21936bea7
MD5 de6501645d638e7433e8c0a4782ba771
SHA1 30f60494c749728fcf2332dd81ba2ba9d184c2fc
SHA512 4e5e28384adf83911007a238ebe3843545f415974bfabfa4cf43ec278e3b863caa94e09cfaa2e3518e26e0d2837f4403f0d46eea55ea3e942475d2735dd55bab
SSDEEP 12288:U6PCrIc9kph5qiWCLLiJSJw9owMaKDSX:U6QIcOh584LTeSwnK
TLSH
T16894DF2435C1C077E2D312308AEADB662A3A7D754B22A5D727D46BAE5E703D1EB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5092	798B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5092	798B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_de6501645d638e7433e8c0a4782ba771_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	798B.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5092	798B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 5092	4556	2026-08-17_de6501645d638e7433e8c0a4782ba771_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_de6501645d638e7433e8c0a4782ba771_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_de6501645d638e7433e8c0a4782ba771_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\798B.tmp
  "C:\Users\Admin\AppData\Local\Temp\798B.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-17_de6501645d638e7433e8c0a4782ba771_elex_mafia_stealc_tofsee.exe BFFCA712CB88194F8651B55149B078FDDCD6F15DF7DB31B77045685549242118589F4B219B600C06C3324E0604F2EF205737767B0014AF00BF7D07CFEACEE92D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

798B.tmp

Path C:\Users\Admin\AppData\Local\Temp\798B.tmp
Size 412KB
SHA256 50604900c04d374aed2d75dfa8f00132747e0c54b418409fc25a688746dae25a
MD5 433181da479b885a5bd053ebaf8515fe
SHA1 9a2ddafe574cb802e9ad402eef0c2b21635bc9df
SHA512 227b1356c7a22dc6af8437915973e2a38ff110dec0e2731b0d761485f28457ed852e7321dde303fdd2c035423184b2be2ae2dc73a52c9aa0b5cb38d499f0b74a
SSDEEP 12288:U6PCrIc9kph5eL5Mj+Zm6MqjcPxg4VV+c:U6QIcOh5m2j+o6MccPiu
TLSH
T10994D0243685C037E29306315EE5DB66697A7D358B21A9C77BE46BAD2E303C1EB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads