1ce0d88952001aebe60d5cf882c0962e67870665c3e763f0b2131897c89f33a3

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/08/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-20_020ed61cdf26683784682f0cc8149e4d_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260821-bgflbazdld
SHA256 1ce0d88952001aebe60d5cf882c0962e67870665c3e763f0b2131897c89f33a3
MD5 020ed61cdf26683784682f0cc8149e4d
SHA1 4551d7555fd1451379912665ee2d64aab84115df
SHA512 0439d78ebd130b20a7b8f2a2123620115edde76e48d1ae484c05a90e50b1911e41f33580ae76b0aed2313a17181c9dc89e66cb413b7a2671a4131fc78c8f97b6
SSDEEP 12288:U6PCrIc9kph5lCqhXV85DJF6RgpOzvCNdrh:U6QIcOh5lCYVyDiRgN
TLSH
T1F894DF243581C037E19306348AEACB76693E79718B26A9C73BD4676E2E713D1EB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4532	165D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4532	165D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-20_020ed61cdf26683784682f0cc8149e4d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	165D.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4532	165D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 4532	1352	2026-08-20_020ed61cdf26683784682f0cc8149e4d_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-20_020ed61cdf26683784682f0cc8149e4d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-20_020ed61cdf26683784682f0cc8149e4d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Temp\165D.tmp
  "C:\Users\Admin\AppData\Local\Temp\165D.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-20_020ed61cdf26683784682f0cc8149e4d_elex_mafia_stealc_tofsee.exe 47A88516725B9D24109D08DAD27D314A73B8B0CB5670F5B18436DD18918E5F4968D48986EFD7261EB61996D27853E616824637CF7155B6D69ED01BB2842CD2F4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

165D.tmp

Path C:\Users\Admin\AppData\Local\Temp\165D.tmp
Size 412KB
SHA256 26b59127150db318c5944607c790554d69a4eacbb9c76daca4f337fd7a3180b7
MD5 575c453246243bb6adb7fd60554da927
SHA1 235a0e811ee979b945786568eb09d2df8dd50ce0
SHA512 e57bb046e26bf772d0a39ac654728a58ff2d2321f281ba33a57fb72cff1f80b770cfee86b3ad5e2d6e78d3b922ce76913456103202715c07cc9e5e6a79e381e4
SSDEEP 12288:U6PCrIc9kph5K07Da9GGVQwDxVwrjsCMbgn:U6QIcOh5xH2JVQcxVUM
TLSH
T19D94E0203581C076E5E301318AEADB66193E3D754B62A8C77BD46BAE2E747C1EB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads