76d0668e98abaa8c3d551155e7fcfcfac95cdf5d87123c925c9e4795219bd5a5

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/10/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-01_3b9d577639a53ef8a9bfca3493594b9b_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample261002-twl1raxfrf
SHA256 76d0668e98abaa8c3d551155e7fcfcfac95cdf5d87123c925c9e4795219bd5a5
MD5 3b9d577639a53ef8a9bfca3493594b9b
SHA1 6a10203a7427b3f77b97f4590baaae55b915454e
SHA512 dcf5ad6a6eb3ffe239b910797d6ee576160ba25e8db2f08650cd60db99fe744e1b44c211ef05167a533823b57e30930ff4ec5cf18fce3bd64739c53940b650a6
SSDEEP 12288:Wq4w/ekieZgU60spIZq3r2yAskmZzNpl:Wq4w/ekieH6br3Ask+zNp
TLSH
T17E94E0213586C037E1A705348AE5CBBA693A7D654B36E4C73BD02BAE6E702D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4160	68A3.tmp

Executes dropped EXE 1 IoCs

pid	Process
4160	68A3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-01_3b9d577639a53ef8a9bfca3493594b9b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	68A3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 4160	5084	2026-10-01_3b9d577639a53ef8a9bfca3493594b9b_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-01_3b9d577639a53ef8a9bfca3493594b9b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-01_3b9d577639a53ef8a9bfca3493594b9b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\68A3.tmp
  "C:\Users\Admin\AppData\Local\Temp\68A3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-10-01_3b9d577639a53ef8a9bfca3493594b9b_elex_mafia_stealc_tofsee.exe F9865957D67910888E5517544ED906392E8FD7CE92E496B692088156E9D54F3F758AA879FE118C59DBB3BACCAAC2220CDF4625D843BBFC970F9B7D10009A108B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

68A3.tmp

Path C:\Users\Admin\AppData\Local\Temp\68A3.tmp
Size 414KB
SHA256 9686a741e42b3ca132970ea861d5c6eadf38117156d18e86aca100b5aec81b51
MD5 49d2d81c3ae00099730de71aa32cddfc
SHA1 1136c0153ff8a936b99554010c32e5d3e407fd2e
SHA512 854de39f9c235b87a7771a0ab4227456cddba8217d218c199779f27901384a45990dc33e455eb69c3d12fc70bf7f8c03b5b2b2170e0d3c1b840b64243515492c
SSDEEP 12288:Wq4w/ekieZgU6qoPna96sBt1MaCvoiRwsl:Wq4w/ekieH6q94D
TLSH
T11194E0213686C03BE1A3163447E1CB7A29397D654B35A4C73BD42BAE6E742D2DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download