9c56f40e65aa6390570ea9593c429523cedf092b46531402e22eab499b0c5701

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample261102-brw12set2z
SHA256 9c56f40e65aa6390570ea9593c429523cedf092b46531402e22eab499b0c5701
MD5 fedcda4d8af7851f1f0f6001a65e239b
SHA1 b4f970d454e3a09ae9617aa7cb477d8f9fc1b46a
SHA512 9d2ec8cf63fd1d16f1e7d58bdd718388aa8e6d582a974bf6705fbcae95e1b18e151a9b4ab0b820936e070ca1a80dd46552674523895bfdab3108b1a2f4ee782d
SSDEEP 12288:bO4rfItL8HAK8rd2xA086lCMF5dl7st8U75UO:bO4rQtGAK8WA0VlHTdl7tUVUO
TLSH
T1EAA4F129B2818133E29303715FE6DB96A63E3571172AE4C33BD4426D2F616E1D37638B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4148	3EC4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4148	3EC4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3EC4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5980 wrote to memory of 4148	5980	2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5980
- C:\Users\Admin\AppData\Local\Temp\3EC4.tmp
  "C:\Users\Admin\AppData\Local\Temp\3EC4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-11-01_fedcda4d8af7851f1f0f6001a65e239b_elex_mafia_stealc_tofsee.exe 17B153FB2D0AB8478368AFB80F16238A20B5F2E0171998A8C7C77F5B62E5EAC5031D228B18AA726D49D334B50FA814D867BAA7634F9F4C03385C79524BCC7DA2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3EC4.tmp

Path C:\Users\Admin\AppData\Local\Temp\3EC4.tmp
Size 479KB
SHA256 0da447f443824a09a3024bd200fb8a6f0efb1188312400f375d985cb8b896710
MD5 6bacb79017e4fdc05b320d7f04038b35
SHA1 6ad793be9411ad19a37cc506a21672c5553de325
SHA512 861e7854833e97fb88c921e5a2cb957aabbd2f99cf5766d22b767fcdd4223561fdf0b1e535c1da645621de6610467934365e8fb4f5d4af52692a9e69a4a45fb1
SSDEEP 6144:b9EyS4oMxIkjxcWqHtg88HARRyyE+4pCsmtCXUdX4ZwKqjsyCKh7yc/v575UNY:bO4rfItL8HAkxACEAqjBJJ3575UO
TLSH
T1D9A4E03A76818133D2A302711BE6D7EA763E7571072AA4C73BD4026D1F65AE1C77A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download