a64f96faca93e43889a7b8b5b14880c87719e10c01c574cd077013d31869385d

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 09:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_c082bbc44ed9b23cc7caa6f91b6eb17b_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample261102-ls75tasvay
SHA256 a64f96faca93e43889a7b8b5b14880c87719e10c01c574cd077013d31869385d
MD5 c082bbc44ed9b23cc7caa6f91b6eb17b
SHA1 2050f4a12b34af7b8231f8477e968a16025a1379
SHA512 b5413f2325b24ef1166d339dff19114882f16b5ee18b2413f46701c36149437ad21df063e74da2a8a46e1cdfd20cc9e34fc82b5a4b58b821ee2eee2e36df7b1a
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnjmTuS3McCCW0jNkINMz7NbNTxlJ8gZVP:U6PCrIc9kph5kqQbWwNo9RJ8M
TLSH
T11B94D0343681C036E1A302359EE6DB66593E7E355B22A9C73BD467AD2E302D1EB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4848	2D30.tmp

Executes dropped EXE 1 IoCs

pid	Process
4848	2D30.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_c082bbc44ed9b23cc7caa6f91b6eb17b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D30.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4848	2D30.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2880 wrote to memory of 4848	2880	2026-11-01_c082bbc44ed9b23cc7caa6f91b6eb17b_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-01_c082bbc44ed9b23cc7caa6f91b6eb17b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_c082bbc44ed9b23cc7caa6f91b6eb17b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2880
- C:\Users\Admin\AppData\Local\Temp\2D30.tmp
  "C:\Users\Admin\AppData\Local\Temp\2D30.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-11-01_c082bbc44ed9b23cc7caa6f91b6eb17b_elex_mafia_stealc_tofsee.exe DBF9D0DAC5A527EABEC4A0467351CCD520407A7DBFC0E8D82086CC04307925E29C0C9B71222686C412CCBA7B72582D716A1DB966EC448E141806DF4BCAF54311
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4848

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D30.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D30.tmp
Size 412KB
SHA256 ad2c1675a7ee57f087f758e0ef309711de60da1f4af69411e78520ecc60dc499
MD5 0c303f3f913a530805e39f36ca6ffd2b
SHA1 2db9581c27b557507ec772bb789df4a3673cafe7
SHA512 b1945013278e71fbdcfff4fab4d3fbdd5cc7ee2aa407c3189516a3f28bc350c2930afa5ed67fb217da780603c5a17a059a236303d8e8109001a23f4c0c5da9c1
SSDEEP 12288:U6PCrIc9kph53MBxigoKyUOQ5BkAm3XmNo:U6QIcOh5WRtBklX
TLSH
T1F694E0203680C136E1D305348AE6DB66597E3E759726A8C77BD46BAE2E703D1EB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download