5fa97bb21c3e79c2554fad26569d3f3f6e5f169d7789a7c3307d97504ae80e7f

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/10/2026, 15:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-22_3d590071dbd1201726d4220f185384b0_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample261024-tdcdlacv9r
SHA256 5fa97bb21c3e79c2554fad26569d3f3f6e5f169d7789a7c3307d97504ae80e7f
MD5 3d590071dbd1201726d4220f185384b0
SHA1 6b6ba35943402abb1e8708455f6814a7f44f881b
SHA512 847bebc004ef8e419023d898cfcb89684bc73f05efcf2fdce39dc9579be2ea2069298c7efa2fa0e8c22ab02b5b32ba2686b666fc6a453e11d60d70394a09e380
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFyinA+7f5d8qROp4vzgaJQlXsqHR:gZLolhNVyEQnVd8By8qAcqHR
TLSH
T16094DF25B2C1C036D1A701304AB6D7B1253A7DB15F7160CBB7D83B6E1EB02D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
5148	3CF.tmp

Executes dropped EXE 1 IoCs

pid	Process
5148	3CF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-22_3d590071dbd1201726d4220f185384b0_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CF.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5148	3CF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 5148	3040	2026-10-22_3d590071dbd1201726d4220f185384b0_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-10-22_3d590071dbd1201726d4220f185384b0_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-22_3d590071dbd1201726d4220f185384b0_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Users\Admin\AppData\Local\Temp\3CF.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CF.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-22_3d590071dbd1201726d4220f185384b0_elex_mafia_stealc_tofsee.exe 1DFE13D38A2133EBA46DFB487777920F359E5CE277214F41FC7C6D503D50F61842529161D2456B4C1C59259072A57482CF3FD936788FB9870F103C70FE742BE1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\3CF.tmp
Size 428KB
SHA256 0c72ba31d617721e3aabb5e5b8ba216ed45a2f1e5ae6d34a63f713841853c671
MD5 2c4dc55f658534a63c6765ce692d04e9
SHA1 02cb2f6ec9c2f54dc76e35f0864cf34916642b6a
SHA512 35ce6673979ffe07f549cb8893e22e6b78ae3276e590f948a023138cea6576411686763be9119f1bc20b47a102a2926dd79080d74d83291ee409d0634f21410d
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFvKx3QmS5YzSQef/JgwMzfq6+Td7Y81XqHR:gZLolhNVyEAUSizSQeZVsfqFd7YCXqHR
TLSH
T18194D029B2C1C036D19301314AFAD7B6153A7DB15F61A4CBB7D83B6D1EB02D19A7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download