9749bcffe47ac26fb8d5419a546d6f3b3ca020c64f3c19ae920687fa8a229d56

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 07:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_d1a7eee472cad2651fd13a4760c69112_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample261102-jsj2waav2p
SHA256 9749bcffe47ac26fb8d5419a546d6f3b3ca020c64f3c19ae920687fa8a229d56
MD5 d1a7eee472cad2651fd13a4760c69112
SHA1 ae76e77799eef379aa875b69cb20cd1a121abde3
SHA512 cff180014f3b63f44735a8697f6daa3cb9853780c3bb7e99b2faee0f3a54d5e8abd8609146c8c593b47c78430fd8dbea5b9dc5642c42d08f32c7d7ac73d6b1a5
SSDEEP 12288:bO4rfItL8HANyFnC9cYkeUe3GtUOngOTi/X75UO:bO4rQtGAhcY9UeWt6fVUO
TLSH
T1C6A4F1267681C133E29312711BEAD79AAB3E35B14726A4C33BD4027D1F646E1D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4796	33A9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4796	33A9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_d1a7eee472cad2651fd13a4760c69112_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	33A9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4796	4664	2026-11-01_d1a7eee472cad2651fd13a4760c69112_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-11-01_d1a7eee472cad2651fd13a4760c69112_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_d1a7eee472cad2651fd13a4760c69112_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\33A9.tmp
  "C:\Users\Admin\AppData\Local\Temp\33A9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-11-01_d1a7eee472cad2651fd13a4760c69112_elex_mafia_stealc_tofsee.exe ADF18404EA5D39B373DAB414C3B7845523350D836068C2C406B555C2493A70CB72F273BCD84D7632F089F02FE5C8152B726684DB7A994670EDFA01B0550E2DA0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

33A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\33A9.tmp
Size 479KB
SHA256 49322c1e503663a8905fdabce7ab23133763e366d258c1c02e19e28b45b21693
MD5 c36538107a6375e2977c87001ccaf431
SHA1 8659588aa60944d79fe8ddd7343cd005c9e7f5f9
SHA512 35d40d834d22b3634a5b2a1fefc9e422389faf3ad73fde92054ae7813de18ab5cc9c0a785bc57b5e0c0fb1d17c8515d3f4cdfb607cf28aa6cb06b5400606ff5e
SSDEEP 12288:bO4rfItL8HA89tg54lFmdF8WqKwY4775UO:bO4rQtGAEZjmdFmVUO
TLSH
T106A4F12AB6418133D39302315BE6E7AAB63E74711726A4C73BD8027D1F656E0D37A387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download