7974caf14242554a17e88e59b64c01266992c4068a52c7f3649cb567659b4407

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/08/2026, 15:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-18_2300262bfa1229c63073ef1274d30910_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260818-sqpc9avdma
SHA256 7974caf14242554a17e88e59b64c01266992c4068a52c7f3649cb567659b4407
MD5 2300262bfa1229c63073ef1274d30910
SHA1 dae95268a5673f6caa3517451c403b30d677f378
SHA512 962a44c2b1ba6b6290521015d216101ed0e12919af38f57040da669294ab44443bea9e9d562b9735c38f10bd874f47f91bc367275ea7a5b1629d5952f82728e1
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFUxAcmb1yalYnidRTEV47F+da9blHBNu9dqHR:gZLolhNVyELAcmZya+GRTEOkdKhoqHR
TLSH
T16E94DF28B2C1C032D19305314AB6D7B5653ABDA15F6164CB77D8373E2EB03D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2608	7A37.tmp

Executes dropped EXE 1 IoCs

pid	Process
2608	7A37.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-18_2300262bfa1229c63073ef1274d30910_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A37.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2608	7A37.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5960 wrote to memory of 2608	5960	2026-08-18_2300262bfa1229c63073ef1274d30910_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-18_2300262bfa1229c63073ef1274d30910_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-18_2300262bfa1229c63073ef1274d30910_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5960
- C:\Users\Admin\AppData\Local\Temp\7A37.tmp
  "C:\Users\Admin\AppData\Local\Temp\7A37.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-18_2300262bfa1229c63073ef1274d30910_elex_mafia_stealc_tofsee.exe F739C819F24301B5E29D92F9A10D2F3963975F0206EAFAFE3D70425611CF945F41F01355F6DA94DD79AE070F47DA9AE3CC4959028562EC75F499F899396A8DE8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7A37.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A37.tmp
Size 428KB
SHA256 acb6f56e7c0c3dfbf34f7b87144a61b1fd2dc24ca35e06f28cb05f654a7fa4ba
MD5 aa39fc0f238916558c031cfed5503fb5
SHA1 f3397398fbb9492f42f9613ac5dc5e516ef099d9
SHA512 40bb372bf4cf2fb93b3b8d8d31d0e9ab85d1a9682090f1710280618bfbee411f7ec8f4d6c30d1942a9589c775e6874252ad470875b7066e1ee1bb4f041662c85
SSDEEP 12288:gZLolhNVyE0jlqqs6U3CpRzOSZ21XpqHR:gZqhOE0Jq+UERR2JY
TLSH
T10994CF24B2C1C032D19301314BE6D7B6193A7DA15F61A4DBB798372E1FB13D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads