693b01fb1f9b3fe006c24f7ab134e96a4bd018e1b3c4a8d7e6de0360f54e7bdb

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/10/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-10_3ca057f41f1794d3231bd7a229f1807f_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample261011-tx9hfacv8p
SHA256 693b01fb1f9b3fe006c24f7ab134e96a4bd018e1b3c4a8d7e6de0360f54e7bdb
MD5 3ca057f41f1794d3231bd7a229f1807f
SHA1 e1d62222e1799c76911c3bf8d8793a6ee13f080b
SHA512 ec11c54a5fd0759f25f784ebd9c47a63bdc041a1e2781b1b661563e5c9e8a3d59d4e5a0f111d5d88ef92d0b621f38e0e8e9e2491cc1f5e36faaa15e91ba70735
SSDEEP 12288:qO4rfItL8HGmH15+0/Vj9IrwQXX/Mn7H8Sw0csK7bWmeEVGL:qO4rQtGGmH1MG99IrvX/Mn7crumeEVGL
TLSH
T136A4E13A7285C133D69302705BEBDBA6A63E7574072294C37BD4027E6E616E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4132	45B.tmp

Executes dropped EXE 1 IoCs

pid	Process
4132	45B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-10_3ca057f41f1794d3231bd7a229f1807f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	45B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5456 wrote to memory of 4132	5456	2026-10-10_3ca057f41f1794d3231bd7a229f1807f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-10_3ca057f41f1794d3231bd7a229f1807f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-10_3ca057f41f1794d3231bd7a229f1807f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5456
- C:\Users\Admin\AppData\Local\Temp\45B.tmp
  "C:\Users\Admin\AppData\Local\Temp\45B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-10-10_3ca057f41f1794d3231bd7a229f1807f_elex_mafia_stealc_tofsee.exe 3BC113F984FFE9C782BF5E9C53850F519EF199732C534CFABFBC73BE5C1F55314357634D23805831F3CEF1119EFB7BF67DC9BBC7C0E73E497716C21261222C25
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

45B.tmp

Path C:\Users\Admin\AppData\Local\Temp\45B.tmp
Size 468KB
SHA256 03d893dae2520b75032cc2a3a87128aa8c2ffb2a1eb8897c0e0fd77b460bf3df
MD5 77dd0daf33ee1ac7fddb147e0026a3be
SHA1 d0f7ce4061042d9e283a1a034612674787f1ad21
SHA512 de90d8be848cfd10c9403fc0f7e9d1e0bfb8bbe982a30559b50c53daee5306ef68188f11c199a0be14abfc59a6961b2d4353aab906b9e780dce4451cf3cb951e
SSDEEP 12288:qO4rfItL8HG3qcpmoUxoCEPkPDKlVEt7bWmeEVGL:qO4rQtGGxhUxf4kPDKlVYumeEVGL
TLSH
T14BA4F02A7681C133D29302751FE6DBA7663E78B10366A4C777E4423D2FA16E1D33634A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download