5f95367d4758404ba9d72d7d5708472bf1c9a94ddc9e2a78b2695ac9ec28feac

Analysis

max time kernel
150s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 00:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_13e8e5b932435d399e88429917fa8dd6_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260818-a4pxtstakh
SHA256 5f95367d4758404ba9d72d7d5708472bf1c9a94ddc9e2a78b2695ac9ec28feac
MD5 13e8e5b932435d399e88429917fa8dd6
SHA1 3aa78e6bc0c4bb65d42708d35190ee990a3c9893
SHA512 95987d65f9eee85e7feb285f0e0a7a66ee7bc65f7c65b8d4d4c83a3f6937e9a990f0171ec5e52d0e2819850514ab687feb4992a017ba2a82eac20a567429f703
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFeSpQ7SL0ScO83h4NYKHSDqRzOwWBpJdNORqHg:gZLolhNVyE5JqY3hP+Rz+GRqHg
TLSH
T14794DF28B2C1C032D19301304BE6DB76653A7DB55B6564CBB3983B7E1E713D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
264	6B53.tmp

Executes dropped EXE 1 IoCs

pid	Process
264	6B53.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_13e8e5b932435d399e88429917fa8dd6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6B53.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
264	6B53.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4868 wrote to memory of 264	4868	2026-08-17_13e8e5b932435d399e88429917fa8dd6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_13e8e5b932435d399e88429917fa8dd6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_13e8e5b932435d399e88429917fa8dd6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4868
- C:\Users\Admin\AppData\Local\Temp\6B53.tmp
  "C:\Users\Admin\AppData\Local\Temp\6B53.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-17_13e8e5b932435d399e88429917fa8dd6_elex_mafia_stealc_tofsee.exe AAC2F279938F5EC26AE69A1BE0ACF8B016279E655625059B8773693C525FA354AEA8E2AAB5197ED76CE3F2F5FE313B429A9DE14C4FB0947D12EA885A8023780E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6B53.tmp

Path C:\Users\Admin\AppData\Local\Temp\6B53.tmp
Size 413KB
SHA256 3a2db95fc98fe5bbd4d7dffb70fc81f32160718f800d65b23d442b1e9b492104
MD5 42139ad177384abe6fcc177a9e57c27d
SHA1 49083e4d5bdf94c20a15f5d5367cef40e0cd7dc7
SHA512 e5f15205697dcdacaaa74489e6178abfd4bd6ed060ec6773e3834e276042e4aa1566484bc5848c5745ecc2e10fce26291813ded1a2c9e99a644978a037e487c1
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFZq63QUnQ7LFQdiJOr5ucD7deoPuXkx969aOqHg:gZLolhNVyE1tUnOpQ8YrkwZeEu0POqHg
TLSH
T18194CF24B6C1C036D59200314AE6E775253A7DB65B65A4CBB3D8377D1FB03D1AA3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads