b30d129b7af3e26b0b181165297da08666339ee5f1235d785a373dca749b27ed

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/08/2026, 07:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.exe
Size 981KB
Sample260822-js8egaselg
SHA256 b30d129b7af3e26b0b181165297da08666339ee5f1235d785a373dca749b27ed
MD5 b07b4cd0c9f4296c0a87afd49b2c88c0
SHA1 6a2e09da6a1a45ba9caf9dfb843aa980388bd261
SHA512 b123d6b0552563ff18261cd2eacd67c334db6d3ee4610179a91a1579a4c1a00eb0c7a93ec9ecb35ad99ab7930a99a877fc2d6b5baf05353743ef3c3dcbd40c83
SSDEEP 24576:FXTo8BK2MRhFILPpN2lXLZmym833ofI+Xf5xbPh:FXTo8FmILR07Zmym8SPpP
TLSH
T1F0250111B9808076D5D529320EF9C7120A7B3EA647E6B8CB67C07B153D72CD1A7393AE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4748	6A68.tmp
5036	2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.EXE

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A68.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4748	6A68.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 552 wrote to memory of 4748	552	2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.exe	89
PID 4748 wrote to memory of 5036	4748	6A68.tmp	90

C:\Users\Admin\AppData\Local\Temp\2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:552
- C:\Users\Admin\AppData\Local\Temp\6A68.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A68.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.exe 5B922D825229CDA15FB7B59EEB60C38B9D7FD0449EBB67DD82FA010D0B24C8047BBDC425B1C2415A807F1B7FC249BB26F95255C1BC85FF7A0AFFE495442FB69C
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4748
- - C:\Users\Admin\AppData\Local\Temp\2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.EXE
    "C:\Users\Admin\AppData\Local\Temp\2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.EXE"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    PID:5036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.EXE

Path C:\Users\Admin\AppData\Local\Temp\2026-08-21_b07b4cd0c9f4296c0a87afd49b2c88c0_elex_mafia_stealc_tofsee.EXE
Size 1.4MB
SHA256 98987578c600dd5a8789ceff6dd031e11807b5b05eececc0566feee1485e6ca7
MD5 2300108f6605bdcd33dc98c7a321671d
SHA1 3d77097930b85bba06e5ed9f37488f6d099ad63c
SHA512 1dd276c53b2917b1c0bec26d6670a86988d2893959df86e014c2ce8b3d0230896f7c8789e072f5ee44f4b0e0754a9aa643e42e3ae5c8167fc74a24815b2c837c
SSDEEP 24576:2LZmQR3caJZLZmvNzc0TDZodoSRsfHMbvmQTZ2:yZmQyaJ1ZmFcqi+SRAG+X
TLSH
T109655BC3F90181D8FCA92D754C3E5E401AA13FABA6C43C1A609E770639B3C93566B95F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

6A68.tmp

Path C:\Users\Admin\AppData\Local\Temp\6A68.tmp
Size 981KB
SHA256 b34c81e35a1d687e99b5b534d8b5152ace753216438b32f151f09b02c4d8af5a
MD5 0375277b62027adb99a1e56faad5621f
SHA1 63ae62a3c7c8d76abe99a37f28242f97043a22f3
SHA512 9e82d02412ad1ab17d4090b426d8b1d70ccaae5ec078b99ecec8ecf4313ddc366868e79ef78218fc208f92c3cdf0c689f5a69358d140d3e6cf46214c6a71c748
SSDEEP 24576:FXTo8Itit2POsX7UeLZmym833ofI+Xf5xbPh:FXTo8Eit2/RZmym8SPpP
TLSH
T115250111B9808076D1DA29324EF9C7120A7B3EA647E6B8C767C07B153D32DC1A73929F
MD5 SHA1 SHA512 SSDEEP TLSH