717d05f9a3828d64d961ba3a5da9800747ba941672fb8cc870d9d499f288f1a4

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/10/2026, 17:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample261030-wasmhszzcx
SHA256 717d05f9a3828d64d961ba3a5da9800747ba941672fb8cc870d9d499f288f1a4
MD5 c3265cdb5407d8a9aed95475c8953ca0
SHA1 3e0a8424bf4824769a2170d46257533e99a58667
SHA512 c9cdb07e1dba88bf2886e9107c651b20720aed8e19e5d31c0a70ef1301cf2afca40b4d28d337085afe57ed2ae5fe7b664bcc2628b010da29747751065b7ea83a
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZn57TeVZmvAMwRmu7lY1Cswnp/K3yUZr2sCsiP:U6PCrIc9kph5CVZmkJLswAIW6
TLSH
T1E094DF203681C077E2A315319AE6DB622A3E7E355B21A4C77BC467AE6E707C1E735307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1896	D102.tmp

Executes dropped EXE 1 IoCs

pid	Process
1896	D102.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D102.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1896	D102.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2368 wrote to memory of 1896	2368	2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2368
- C:\Users\Admin\AppData\Local\Temp\D102.tmp
  "C:\Users\Admin\AppData\Local\Temp\D102.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-10-30_c3265cdb5407d8a9aed95475c8953ca0_elex_mafia_stealc_tofsee.exe 7F837B9AA32EB25535FD694C77CAA430DD306169924E9253C7908F61D9762485BA2A0F0F75743D11CB557F7460ECF8FC40D64543322F78A5781DCEF73ECF4A48
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D102.tmp

Path C:\Users\Admin\AppData\Local\Temp\D102.tmp
Size 412KB
SHA256 897c94bff7769a419cddcc911b9d6d163eb1f83a042ecaa25bd9fee8e315dcce
MD5 ccdfb60983e35b6282c45e79006f85a8
SHA1 9e79e9778531bae1d62aa05f7fc730b4423d5c23
SHA512 aaa6c29e6d4eec909660bb46c4d0b30992c9cb6343f7e4e9f85f6903281ed133b70b97e551d96c16f29923c1d0911e4f2dce8ac4bffff3a836a02ef4a712ef6e
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnpV+Y8lRVnjHuMGIARX4SGZQB7NbuNHFhIxP:U6PCrIc9kph5XVT81ixR7GZeNCNYR
TLSH
T18F94E0343681C036E59315348AE6CB676A2E7E754B22A8C73BD45BAE6E743C1E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download