cb39fbeb6d4590f11a3c60fd1d7c8ff0fd1aa2644d9be2a49f4a3e8de84550a6

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 17:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260817-vwtahaep4y
SHA256 cb39fbeb6d4590f11a3c60fd1d7c8ff0fd1aa2644d9be2a49f4a3e8de84550a6
MD5 feec83b80269d32a2eb2aca04425407b
SHA1 2ac09ae8d4ebfdd115c410c95d4b13fee41ccb8f
SHA512 22f7b633cd7466eda216e098930bf463902a61f2958bce79a809e31f71ac4fa97cc1a1cb7e499df76f806083e1ef05c2d38cda68b548f79858842902329f72c5
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHSz/2/IbnDSsZYPU2PnS6u6Z:Zm48gODxbzonDoP5DJZ
TLSH
T19E84CF347281C037E19601314BFAEB611A3A3DB64B6468C77BA47A6D9FB13D1B63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5832	BFB1.tmp

Executes dropped EXE 1 IoCs

pid	Process
5832	BFB1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BFB1.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5832	BFB1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 800 wrote to memory of 5832	800	2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:800
- C:\Users\Admin\AppData\Local\Temp\BFB1.tmp
  "C:\Users\Admin\AppData\Local\Temp\BFB1.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-17_feec83b80269d32a2eb2aca04425407b_elex_mafia_stealc_tofsee.exe 857A58F677CD7E033D01958B597DAC05BD4F30C6FB72554B3B6B2AAA547371390C60669AE8F8E86056D002D7304FFC0F095CBA67DD1CFFF9D34D18CCB69378F3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BFB1.tmp

Path C:\Users\Admin\AppData\Local\Temp\BFB1.tmp
Size 384KB
SHA256 22a435e78c3c502c648c2a363ef22f28ec31ec75e42820f142ba6371a52850fb
MD5 152531781ffc79ad3b566d7479d191e4
SHA1 6a20ad137550305f3de10ed5da19521d869b0fd2
SHA512 871113d8822e64709b9a652c3e6b89089e659b5b9282884169a4e6c2afc23567b2af85b8bf7277a2e53dc40a2218eb958a8d324e545c53ce62715ef1cd04ea6c
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHcZSYxiqXYwd/hUcFOcpDC2B0GqBZ:Zm48gODxbzSMCXbmcFO2dB05BZ
TLSH
T19184DF3875C0C036E19601314AF6E762193B7DB28B6068C77BE47B699EB03D1A77835B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads