83938e08af365a6f371fcacb523e28533a2fb85aa7eb21ed8a4b316df84204b6

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/08/2026, 12:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-28_885091f1bec63465c36271fdd9bcfbe6_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260828-pzxt7sch89
SHA256 83938e08af365a6f371fcacb523e28533a2fb85aa7eb21ed8a4b316df84204b6
MD5 885091f1bec63465c36271fdd9bcfbe6
SHA1 4a1c82675e1322ddfbb8dfb35270b9019a8517a0
SHA512 797a10e463473ec7e30d70ea707b0c0d9b8883ac811a0e762d6494b1c71d8951371d01aa8c3fbf3b7a76f9b693e3a7de20d05d7a52f970e627d21866f870776c
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFHCTU7qW32aTVsKFsV94Nb3YaybhenqHI:gZLolhNVyE0/RmosKFS94254nqHI
TLSH
T11794D0287281C032D29301314BB6D772697A7DB55B61A4CBB398377E1FB03D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4780	3CA2.tmp

Executes dropped EXE 1 IoCs

pid	Process
4780	3CA2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-28_885091f1bec63465c36271fdd9bcfbe6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CA2.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4780	3CA2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3564 wrote to memory of 4780	3564	2026-08-28_885091f1bec63465c36271fdd9bcfbe6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-28_885091f1bec63465c36271fdd9bcfbe6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-28_885091f1bec63465c36271fdd9bcfbe6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3564
- C:\Users\Admin\AppData\Local\Temp\3CA2.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CA2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-28_885091f1bec63465c36271fdd9bcfbe6_elex_mafia_stealc_tofsee.exe 6150162CD4282AA5377F5B2C36BEAF8725185A693A29E5B62F3CEA80EB0FBA8FB1611AE039BD41ABF814921E72B1E775030A3DDB33DCFC3C244A07D3F8D66260
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4780

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3CA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\3CA2.tmp
Size 411KB
SHA256 6eb01246c19bf1f4985e47536c9a4779e5f172de361c5ee6ea4af5143c1e7083
MD5 2a725f8d3ccf2df4643b676872ab2990
SHA1 8246a4e874fe24f576a8a9ca21018c4d3e7c6f73
SHA512 b65e46a8e7231a8539e204dc0599cae9111ee0d3202f5bda2d54021c0dbf170b083e1205e88d52990ee5de099576940ab9b6561438267ed55faa96941488ae96
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFVXkdyasfjnua46v+Q3+P5q5ap6UCqHI:gZLolhNVyE6+yawN4/3I5aMjqHI
TLSH
T19494CF29B2C1C036D19204314BE6EB76153A7DB15B61A4CBB3D83B7E1EB43D1A63931B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads