22a8a500c03b1798e49e161a40425bfc9f1141f540cb0fa39f9aa3c9f66aaae8

Analysis

max time kernel
149s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/11/2026, 15:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample261102-sxrf7axt2m
SHA256 22a8a500c03b1798e49e161a40425bfc9f1141f540cb0fa39f9aa3c9f66aaae8
MD5 8ab4f288f82d8cec8c9c557c8f0b0e7c
SHA1 ac6a411f348f9d938f79f82071cb03a31caca3db
SHA512 d24d656d03f568cb1b01fe757f2d8aaf0ab0fe12f6aee43adea1efe693ad5c37c69437e4993b1840de3a5a8d1b9bd4000282cb01286ca2b46b389584c6c58626
SSDEEP 12288:Nb4bZudi79LG6er+47zwIEH20lKEaVaA0a:Nb4bcdkLG6eF7W9lhaVx
TLSH
T13AA4E0203582C037E29706344AE5D7B9667E7DA05F7164CB3B903BAE6EB06E1E634317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
2480	A3E7.tmp

Executes dropped EXE 1 IoCs

pid	Process
2480	A3E7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A3E7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3892 wrote to memory of 2480	3892	2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3892
- C:\Users\Admin\AppData\Local\Temp\A3E7.tmp
  "C:\Users\Admin\AppData\Local\Temp\A3E7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-11-01_8ab4f288f82d8cec8c9c557c8f0b0e7c_elex_mafia_stealc_tofsee.exe 3B1E0BE964BE8C32AA8AB52BA71E393B876D19E04B3C3224256311382A630DADE4CB6279024C4ED11E310F2E63CF8016F052B2A95735454283B3E33EFAAC1BAF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A3E7.tmp

Path C:\Users\Admin\AppData\Local\Temp\A3E7.tmp
Size 473KB
SHA256 d8284163f2f301d462ce058a0dd9de23915f6793ff0a223fed2759b1a67a4d2d
MD5 55c3b6710afea6b7f04a775af1439023
SHA1 102c10fa62675de06add059ab8be5209eefa9c3e
SHA512 17add17f5230df72e818e3f941e1c0729d466dfdcf5ce5818563fd899352937747072204540abdd5b268411e65b712fb41dd5129f8cfbd16db6f538c7a93693f
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStlq/fO2jgD5jMyDFOEeHIeZIdyBt13mZBpVd:Nb4bZudi79LudDpv5eHfIcD3mPjTKA0a
TLSH
T16FA4E0257581C037E29B12350AE6C7B1963E7DA15F21A4DB3BC43B6D6EB02E2E674307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download