a62b8d915a2138afc2b96cb1cb9e97d123a4230aa4fa8e720320555da1ba7820

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/11/2026, 15:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-03_7e20523df8f8773af8db145d1b73c139_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample261104-tcatdaxy4q
SHA256 a62b8d915a2138afc2b96cb1cb9e97d123a4230aa4fa8e720320555da1ba7820
MD5 7e20523df8f8773af8db145d1b73c139
SHA1 c11657866f61b4260c53096cdaf70d5903e237f4
SHA512 446f84842d41c57059fd2726bbd2f80288589265e17b09f5cdfaa41a6bec2afaf2e2f334f9511ffe8978ca2e824a00529e8c6bc4f5850bf4d0500f3d9c61c67d
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFvLWznoKhdlDa2K17KZM5izQa/o/l6uA/wK8KqHI:gZLolhNVyEIiznzRK5GM5/48UD8KqHI
TLSH
T1BE94DF287281C036D19300354BFAE775153E7DA55B6264CBB7983B7E2EB03D1A63A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
3320	616F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3320	616F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-03_7e20523df8f8773af8db145d1b73c139_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	616F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3320	616F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 3320	4712	2026-11-03_7e20523df8f8773af8db145d1b73c139_elex_mafia_stealc_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-11-03_7e20523df8f8773af8db145d1b73c139_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-03_7e20523df8f8773af8db145d1b73c139_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\616F.tmp
  "C:\Users\Admin\AppData\Local\Temp\616F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-11-03_7e20523df8f8773af8db145d1b73c139_elex_mafia_stealc_tofsee.exe A95749A9DD46504D7C060BD071964DEAB2BEBA14C84A966C251CA6F8E86D604FC04D8BBC84AB68DFDD4FEEE6CA0A5A2AD6EB441C721711A07DA647345F02F56B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

616F.tmp

Path C:\Users\Admin\AppData\Local\Temp\616F.tmp
Size 411KB
SHA256 470aac61437c970da665cec2805a9f29508b28f746319830336eaa4651460020
MD5 98bf219ca3770a7deb3d7f6bc3b3f225
SHA1 a0d9c53ceb973bc7aaa920ed20d0cede75031bf3
SHA512 3f541c17d6e1966e731d20b051bfd8b3c9dd8de4bec1a0d12373f827de3c7a520caa9098917191cdf08229fdec6186b854c4ec3fb520cf4fac5d51bb1048e980
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF/YNruWd9Altc8Sk4RTSVJDJXBlhxpd3qHI:gZLolhNVyE+q9AlfSk9JDJfhxpZqHI
TLSH
T1C894D024B681C032D19305318BE6EB75193A7DB15B2168CBB7D83B6D2F713D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download