bf57c2b9e7e070497658d7d845da7b0f16725fe6a1f3315bf56d1a4b462efbf0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
25/08/2026, 03:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260825-dxy4pswerc
SHA256 bf57c2b9e7e070497658d7d845da7b0f16725fe6a1f3315bf56d1a4b462efbf0
MD5 b5404d807762e93a9214dbc465782f01
SHA1 6364b878172657ce6b59c8a82df0352912ed77ba
SHA512 68627f49141eae543eabeba6e9ee8735e83c7228e7d9407f008bf0b8a9172c6cda345be2eef21ba144d06a69a71651313ac6b348d52f8389b752ab2d69427c17
SSDEEP 12288:gZLolhNVyEd5eG2TpkUkFvoxxkm9NP93qH:gZqhOESZpwFvoTBD
TLSH
T15D94CF24B2C1C032D19300354BB6DB76193A7DB15B6168CBB7D83A3E1EB53D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4156	8DDE.tmp

Executes dropped EXE 1 IoCs

pid	Process
4156	8DDE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8DDE.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4156	8DDE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4168 wrote to memory of 4156	4168	2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4168
- C:\Users\Admin\AppData\Local\Temp\8DDE.tmp
  "C:\Users\Admin\AppData\Local\Temp\8DDE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-24_b5404d807762e93a9214dbc465782f01_elex_mafia_stealc_tofsee.exe 2EA7CEF2F9A165630582F74B5B8E89B27F6C1E8E1FE48B0AAA1A733E24F8D23A98B4BB9AA4218F10A9FA5C5A3F85A98A9E46CB3F11A2636AAAC294764124AD76
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4156

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8DDE.tmp

Path C:\Users\Admin\AppData\Local\Temp\8DDE.tmp
Size 411KB
SHA256 b02780e579047d386a7f4f11e2ea51d94657bf89694b1e8d9a45ec60e6312061
MD5 61666c7ab3fe02dd9aaedb0065942225
SHA1 80ceb761ddd13090aee70f3b2d8c972234ff3fa3
SHA512 2377444356b72e33d858689f1639aa435a7c15e8744018892eb3747e749c27b1aff1ad9c88bc9021f524a338522bc9dcc964be79103d5a62575b1c6bda44da49
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFA3sIgIO4Rofn1qddRyvV/qH:gZLolhNVyEd/gf4Rg8dgd/qH
TLSH
T1E694D029B6C1C036D59200314BF6D772653A7DA15B6264CBB3D83B7E1EB13D1A63A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads