1bb03a4377762b9e66563aa5b5d22470fb2046fcdacddf73d50453afbf97b737

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_411584847463c1f55cf3cb0989f93b3f_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260905-qbc1kassc1
SHA256 1bb03a4377762b9e66563aa5b5d22470fb2046fcdacddf73d50453afbf97b737
MD5 411584847463c1f55cf3cb0989f93b3f
SHA1 25aae303948297eaf0dc6b7e5cba4f1694edbbdc
SHA512 7afc1952e26ff814bb10ce7214aad8ec0c23134fb7c9fab48ca4fb78f5dd305f7280d8f6baac11531bb2c4b6e8a0633a55b318fc4b82b908d8fa66e6f232c0be
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF90UR2oL3u6JT5SEv8Fu7yTdUrMuZaVqHI:gZLolhNVyEgRZ375SEEFuNrMuZMqHI
TLSH
T1E494DF25B281C032D19301304BF6EB75257A7DA15B6264DBB7983B7E1FB03D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4228	3A31.tmp

Executes dropped EXE 1 IoCs

pid	Process
4228	3A31.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_411584847463c1f55cf3cb0989f93b3f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3A31.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4228	3A31.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 4228	2236	2026-09-04_411584847463c1f55cf3cb0989f93b3f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-04_411584847463c1f55cf3cb0989f93b3f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_411584847463c1f55cf3cb0989f93b3f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\3A31.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A31.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-09-04_411584847463c1f55cf3cb0989f93b3f_elex_mafia_stealc_tofsee.exe 893FAA6F4B6B65BC206D244341E5D9EC3D78BD40219BD1D98071C0B02A8519B5E77F2EE022B1BBDDCC53549BD7397E34DC5210E30DB004421BFD5DD6DB7B64D8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3A31.tmp

Path C:\Users\Admin\AppData\Local\Temp\3A31.tmp
Size 411KB
SHA256 2432a44a3bce6f5e524c4c3928b7319316b12fe74ccf8c24010baa078c248ef9
MD5 68484c1f1cb44314669015697362d681
SHA1 1cc7120e09ba8ebf4c4e48897ba05682ca939ba6
SHA512 809eb60e5f0f9200b2cab5fee63bed7befbdf43ab4d97707294e85dc10fbab7f7aef0102e4d0b15d49f72d16cdcc3339ef8bf19e9f11e911e90b5f7f93781392
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF10eZ53Oh8QwODOh4uBy4PrkwnsR9lxLLUcnoPWqo:gZLolhNVyEaM9wODS4u6wnA9lxHP5qHI
TLSH
T13094CF28B281C032E59201314BF6DB76257A7DB25B6164CBB7D4377E1EB13D1A63A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads