194347539dcbaa6af67e1cf7482d17c280578fb3eaeaf353753e7e2cf01ce495

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample261024-dnlr1sft9s
SHA256 194347539dcbaa6af67e1cf7482d17c280578fb3eaeaf353753e7e2cf01ce495
MD5 9c64f393d41306f9d87394e23acb2eaf
SHA1 97d7022f784be9dcccd9ff705b9f5900b5199aa7
SHA512 291dc968c7977940bd413e4bbd4b1d58cbbae538096a419cbfa3e29ad819034781e3f33a862c83c10ada46b4f27ecbcb4ee426210dcff16de58e7e4530da8496
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZne8KuKVvq+HxRH67yge9PEcxatCMzcfCP:U6PCrIc9kph5UDFVvby7yVP0CMgfa
TLSH
T13694E0243586C036E19315318EEADB66293A7E754B7264D77BD42B6E2E703C1EB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
6036	1AA2.tmp

Executes dropped EXE 1 IoCs

pid	Process
6036	1AA2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1AA2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
6036	1AA2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2716 wrote to memory of 6036	2716	2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2716
- C:\Users\Admin\AppData\Local\Temp\1AA2.tmp
  "C:\Users\Admin\AppData\Local\Temp\1AA2.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-22_9c64f393d41306f9d87394e23acb2eaf_elex_mafia_stealc_tofsee.exe 0D63AEDB473F765357168AA1E6BED75AEB639B57CBA55B3DB79DC708B5A392128A0E96516B6B487DFEF1C167239E34570B4C58BAD38E9F6A30997D60FCDE028E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:6036

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1AA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\1AA2.tmp
Size 412KB
SHA256 574b1caeab542228f0907cbb064cdf0bb58c900413ee35bdf2de6e66b633a38a
MD5 aa54c11c7d60e8210d57e2eb1f93c4ee
SHA1 1f3020f24d7c9ca67265acd1ae6c64dd1d9e6057
SHA512 9b00d9e1b704de02f1e420808a48453440c9e107f5a31b66c217ee3a494449592f9d9eb49f778bcf0618a6ef1fa87bc4a38dff37fb3946909ccf11ae6f343a39
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnEpWCjt2IHPMfk4Ugq3m7B/gefqisP:U6PCrIc9kph56kCJ2IHEfk4UpW1gefw
TLSH
T16794E0243181C07BE2E715344AE6CB66693E3D764B26A8D73BC06B6E1E312D1EB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download