f34124337269cce3e18db4a862b92145aa158c0b3ab7a6a1634f9b1f62dbaaef

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/11/2026, 20:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-11-06_e7608d5763b1b39143a82e7e71ea83e3_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample261107-yvx4vaga77
SHA256 f34124337269cce3e18db4a862b92145aa158c0b3ab7a6a1634f9b1f62dbaaef
MD5 e7608d5763b1b39143a82e7e71ea83e3
SHA1 69b4726b6a5cc90fa8c93316c93bc5aa59a45321
SHA512 4e4014999965bfeaabf1a47b557f60c4178a8642296a77c1d3c4a79c791d707986cf01afe6f62adf226d65e01463ddfa805eda8d3f9e39065c6f4bbc3da78ccd
SSDEEP 12288:aO4rfItL8HRUpofyVhBoJ0Wr0MR3ztEFLQ7K9wlsDpVFd:aO4rQtGRUpoaPiz5+9wlsDpVFd
TLSH
T182A4F1257281C133D29302755BE5DBEAAA3E79B4172A94C337D4027D1F21AE1E73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Deletes itself 1 TTPs 1 IoCs

defense_evasion

File Deletion

T1070.004

pid	Process
4484	1D33.tmp

Executes dropped EXE 1 IoCs

pid	Process
4484	1D33.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-11-06_e7608d5763b1b39143a82e7e71ea83e3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D33.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4484	3472	2026-11-06_e7608d5763b1b39143a82e7e71ea83e3_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-11-06_e7608d5763b1b39143a82e7e71ea83e3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-11-06_e7608d5763b1b39143a82e7e71ea83e3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\1D33.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D33.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-11-06_e7608d5763b1b39143a82e7e71ea83e3_elex_mafia_stealc_tofsee.exe 6762D1B9D2158246D94699E50576ADDD2FA8EC33A85A18BD7BE0AD1E6EFE963DB251C99C310731E8A58F6F065ED6697DF59F3A0A876C11C4FE60ECE29EC81893
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4484

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1D33.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D33.tmp
Size 476KB
SHA256 c7b9fdb335d9d45fb59a10b9a1075b380d682f3e125c3a840a9269fce9d829b7
MD5 0825b25aa9134e8f8715836c5ea5b64c
SHA1 1b86849a6eb79e81226d96b5315a6dbd4d934963
SHA512 2beb519257d3c489b691ef478fac81960e6319e6a74efcbfef00054b8d42a3ea79c4778ceb85a94f7eebbae5e738017f5b2f9643266b45eba1856b406f3b0b3d
SSDEEP 12288:aO4rfItL8HRNw0svaX5peWJxSnMh7K9wlsDpVFd:aO4rQtGRevaptJKMh+9wlsDpVFd
TLSH
T1A3A4F12933458233C2A301705BEADB967B3E7575476198C37BE8026E1FA57E1D33A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download