479b0b80a4e24a1a440e1e0307041d9a9f079f8fc4306a416d5c381ec0df7d2e

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/08/2026, 07:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-30_a5a490d6df7b9b77e76f65016f10772f_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260831-h154msfb52
SHA256 479b0b80a4e24a1a440e1e0307041d9a9f079f8fc4306a416d5c381ec0df7d2e
MD5 a5a490d6df7b9b77e76f65016f10772f
SHA1 bba5aa62856f3462fc05d83f53a7e69c617a5bef
SHA512 604d716c355ec7e1c0f8efb3bff60a0067bc2abed9d37e7bb37abb98731ed8adf31998cfecbb3c8e3700a378dee4fcacddac63729d493ead7d31f3a67a2595d4
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFbAnUyV9EjgzM0xD9ZmQAi2uqHg:gZLolhNVyEe4UyV9ESM0xD98QAi2uqHg
TLSH
T13094DF25B281C032D19701318BA6EB75153A7DB15B6168CBB7C83B7E2FB03D1A67931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2936	3CE0.tmp

Executes dropped EXE 1 IoCs

pid	Process
2936	3CE0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CE0.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-30_a5a490d6df7b9b77e76f65016f10772f_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2936	3CE0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1308 wrote to memory of 2936	1308	2026-08-30_a5a490d6df7b9b77e76f65016f10772f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-30_a5a490d6df7b9b77e76f65016f10772f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-30_a5a490d6df7b9b77e76f65016f10772f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1308
- C:\Users\Admin\AppData\Local\Temp\3CE0.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CE0.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-08-30_a5a490d6df7b9b77e76f65016f10772f_elex_mafia_stealc_tofsee.exe 5650C8BC16323ABF1850D73FA5AD6D9CEEC95219448D518F6BFE8BD9006308377AACED0BE158CFA2BE78F550FEDE670812FFEEE713D43616C04FC49935F13EA1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2936

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3CE0.tmp

Path C:\Users\Admin\AppData\Local\Temp\3CE0.tmp
Size 413KB
SHA256 d23611a5512a55eb85976662fb107664646bfc64b18a58b951fe5d6b3cccd666
MD5 72e822d909f99a3f5811cd342064f5c3
SHA1 34844ba6b4660eaa2989900c6ac68e74c5933187
SHA512 73845edec45d67dde5e4dfd25e3dcb2a1127f127fb610fef9465d4d602a0d1bb3d63a464d09e62f13447b3d4f273659021d10d3e9d29a8e73743e7320929628f
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFz1uSSQ0uJWAyYLZn1KYKYwpIqHg:gZLolhNVyE+1uJdAyoJ1KDZKqHg
TLSH
T14194DF28B681C032D59201318BF6D7762A3A7DB15B6264CBB7D8377D1E743D1AA3930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads