d899498813a2bac1a6be1a65381d2415d99a01f9043a979991556263f82efcd5

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_de1b33a4cbde46df400f648d241cab94_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260701-p3cnfaev9r
SHA256 d899498813a2bac1a6be1a65381d2415d99a01f9043a979991556263f82efcd5
MD5 de1b33a4cbde46df400f648d241cab94
SHA1 1c286e3955cbd785f67e754005449098bc7f6405
SHA512 4de78cbae51eab131c0a1ad3694af7df4eea98e8da8a8789bf6ca5b62d0962873b9cd26b0460293808761c6ef493442a9ded15f4a965d10a9358ac1dafec06f3
SSDEEP 12288:bO4rfItL8HA88pLrbBeuQPXygmkLFIZpHBj75UO:bO4rQtGArpDLXpkgxVUO
TLSH
T143A4E12A76818133D69302710BE6DBAAB63E75714726A8C37BD407BD1F606E1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3400	F558.tmp

Executes dropped EXE 1 IoCs

pid	Process
3400	F558.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_de1b33a4cbde46df400f648d241cab94_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F558.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1596 wrote to memory of 3400	1596	2026-07-01_de1b33a4cbde46df400f648d241cab94_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-01_de1b33a4cbde46df400f648d241cab94_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_de1b33a4cbde46df400f648d241cab94_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1596
- C:\Users\Admin\AppData\Local\Temp\F558.tmp
  "C:\Users\Admin\AppData\Local\Temp\F558.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-01_de1b33a4cbde46df400f648d241cab94_elex_mafia_stealc_tofsee.exe 2C48A1130AA82E8416F5EDE278E344B9B20061C001873ADC33E4DBB5BC00D79214E970D1A852D55232CCE2EF1DCDB07E5DD24427B25747EDCF7DCE20790D4E10
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F558.tmp

Path C:\Users\Admin\AppData\Local\Temp\F558.tmp
Size 479KB
SHA256 222a194331713dc608e19a98efe8efcc054b3a4df88e9bb87033a0e41e47d197
MD5 32f0b45905de6c8de8a11ea1cb30bd64
SHA1 e40d0dac9045849b2c6cdbd0c52292f464ef63a3
SHA512 68a326cee1a8ba4bed5c564403b78daf22a5657959427c1186c204c39f7be3e2ffd441539e90362604df08860660f4c418acdbb415d5b4864d335f7322f417b2
SSDEEP 12288:bO4rfItL8HA8WnWq/PcZs3sDqfxBZQbznBRk75UO:bO4rQtGA8W5/ps2fxz2LkVUO
TLSH
T1D5A4012ABA818033E29302745FD6DBAAA73E75744726A4C337D402BE1F616E1D736347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download