77e9058f30f4e1150f3a274c910aa348922fd24dc1fa70986e114f1b75a4b3e7

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 23:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_cb19080d2acc897fd9ec5baa346e8941_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample261107-3cwwaaf17x
SHA256 77e9058f30f4e1150f3a274c910aa348922fd24dc1fa70986e114f1b75a4b3e7
MD5 cb19080d2acc897fd9ec5baa346e8941
SHA1 549cea9cdbee16a76200b3cb4611fc9ba60e3a2d
SHA512 2dc5f7566fad13af3ba6823cee517065652db03558223c4eacb5f5409e619b4c1271e270a9a32e6e25f69adc5f53ee84772cd5ce4f998560494b4344f9e5462c
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFmykTpSYxJqHzmhFm4T1TavKVxEqHR:gZLolhNVyE3pPaghTavKVxEqHR
TLSH
T1D894D02572C1C036D19301314BA6DBB1153E7DA15F62A4CBB7D83B3D2EB12D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
1120	766E.tmp

Executes dropped EXE 1 IoCs

pid	Process
1120	766E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-06_cb19080d2acc897fd9ec5baa346e8941_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	766E.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1120	766E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 1120	5196	2026-11-06_cb19080d2acc897fd9ec5baa346e8941_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-06_cb19080d2acc897fd9ec5baa346e8941_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_cb19080d2acc897fd9ec5baa346e8941_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Users\Admin\AppData\Local\Temp\766E.tmp
  "C:\Users\Admin\AppData\Local\Temp\766E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-11-06_cb19080d2acc897fd9ec5baa346e8941_elex_mafia_stealc_tofsee.exe F93AAD94F844895AEA5077B90C9E1BE63C4CF5E3754E9C6329DFE36F2FB4F2759160E3EB5C12B0B3E20B791679CB71D866C4DA3BFA8735A7502E83AD17CC1C55
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

766E.tmp

Path C:\Users\Admin\AppData\Local\Temp\766E.tmp
Size 428KB
SHA256 608e1b4e7df825566d8693e93652f8418629b547640c252baf23db8a8806034d
MD5 af8cbb3918716875ec639d2f4b72eb79
SHA1 2428208e6ec90e9d02ee0fa7aed3a5771f8fd6c0
SHA512 b0fd641d19422a7050f5edecf6d6027f4fedf381b7ba4d849001e1dc6eae8e9aab0aa879b911bcdb06a784f9cc29085d907149fe653fd4ea044ee51c472d7cfd
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFZwtINF6EGSpcBWGR2OJqDgqHR:gZLolhNVyEcaIq5BTRFJqDgqHR
TLSH
T19094D02872C1C036D19305314AB6D7B2153A7DB25F6161DBB7D8372E2EB43D1AA3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download