f597b97ad5ca644449edc3bab19c53e35611bb1e5094368d65de639c4d768e7e

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
26/08/2026, 10:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-25_c3cc768d099208c9bac0f7c2e647b26f_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260826-mplm3stycw
SHA256 f597b97ad5ca644449edc3bab19c53e35611bb1e5094368d65de639c4d768e7e
MD5 c3cc768d099208c9bac0f7c2e647b26f
SHA1 00a10820f319c8467eb8bdada9f8691e58997f38
SHA512 ec41381fd4e3592304c9c70295ac3fafb53458a1cda61b580cf5f4f28994b8a460762248ac1d4562c6778dd0701f287ceff0e2c4bd591dac0dc7755d8f17f110
SSDEEP 12288:U6PCrIc9kph5bVM166Y+VweuoUiC0XJG2NAj:U6QIcOh55MQ6TVjufLp
TLSH
T16994D0243581C037E19316304AEADB66593E3E758B22A8D777E46BAD2E713D1E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2620	5C6E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2620	5C6E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-25_c3cc768d099208c9bac0f7c2e647b26f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C6E.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2620	5C6E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1136 wrote to memory of 2620	1136	2026-08-25_c3cc768d099208c9bac0f7c2e647b26f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-25_c3cc768d099208c9bac0f7c2e647b26f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-25_c3cc768d099208c9bac0f7c2e647b26f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1136
- C:\Users\Admin\AppData\Local\Temp\5C6E.tmp
  "C:\Users\Admin\AppData\Local\Temp\5C6E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-25_c3cc768d099208c9bac0f7c2e647b26f_elex_mafia_stealc_tofsee.exe A4C5A834B74F51027AF5E4B7D29B85E06C3AFE1CA5282922556A80338D8E9F85392D8FA7BFBFA0C896C9AF7F5BB1A03EE25E089FDF52762BB6FB3CBA463119BD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2620

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5C6E.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C6E.tmp
Size 412KB
SHA256 e8a01b218b80afe185df3b51b1f2a749b368d880edcfc6ddb8b10f28ecb507cf
MD5 7f4b51619c59982f152ddf2287f9e83f
SHA1 a4f8f3388fcb08179a3f6d149c9c16335510ed0a
SHA512 43ad564bc2919027a399cb316dd0b760cfd6dd269ef6a498b3f5af5b63cd0d1c25a6c31d6d24a8a521a27533b5f14adf6216ccdc5e5b8bcdc658860d71474509
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn3DIxw31HJXjnh7kgNz/oxcjPy5hYAa5uhHMz1Q:U6PCrIc9kph598y1pt7PNTekPy4AMM7
TLSH
T12D94E0303581C036E1E316308EE5DB626A3E7D719B6268D73BD467AE2E613D1AB35307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads