a12205719b925236dc239c721ea932ddb4d35ab8c266a276154bb9ec0d9322d9

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_e65b3a305346a6579323fe51e2498ec1_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260702-pystvsgy3l
SHA256 a12205719b925236dc239c721ea932ddb4d35ab8c266a276154bb9ec0d9322d9
MD5 e65b3a305346a6579323fe51e2498ec1
SHA1 1515003f73f581c049b6916e9f04f77c3cc6cdfa
SHA512 ad673fcf27f14759be96bb135d5c79baeef63d42e121b68cb151a0e1fc90c4d0323f6f29fde112c450ab9f525bec8221986fbcb495b9b9e70ea5b0e2d39b554b
SSDEEP 12288:Nb4bZudi79LUkBCmboB6+L0kBsCCKk/oA0a:Nb4bcdkLUkLbU6+QkZ6b
TLSH
T12DA4E0243182C037E2A701394AE6DBB5563E7DA14F6269C73BD03B6E5EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2472	B1C7.tmp

Executes dropped EXE 1 IoCs

pid	Process
2472	B1C7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_e65b3a305346a6579323fe51e2498ec1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B1C7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 924 wrote to memory of 2472	924	2026-07-02_e65b3a305346a6579323fe51e2498ec1_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_e65b3a305346a6579323fe51e2498ec1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e65b3a305346a6579323fe51e2498ec1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:924
- C:\Users\Admin\AppData\Local\Temp\B1C7.tmp
  "C:\Users\Admin\AppData\Local\Temp\B1C7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_e65b3a305346a6579323fe51e2498ec1_elex_mafia_stealc_tofsee.exe 689B73C6B9ADA9876E393B37AE17AAAE06F2F57CED2157415F2505CDF6B4B7D6914C17CEBE846A1298CAF1B7FD3D30BFFDFA45D7575DB530220D936E0B6F6656
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B1C7.tmp

Path C:\Users\Admin\AppData\Local\Temp\B1C7.tmp
Size 473KB
SHA256 4b578964c2faf5b881b4c8819e38a3391f87ce129fae0a60e85f045ac1831606
MD5 995c3cff5fc293589ddc7c09680be04f
SHA1 ee3f85acf6f76de251f39a660d759441cba8f38b
SHA512 0274402579ca8540c591452a71bbdd9c75966707bc0d30aa7321f7fe00c01ddb9e2300af42802a4ff327da46886936f6d074ee23ee68e4b7b8ed76a5fbe188bb
SSDEEP 12288:Nb4bZudi79LSNfGO4ho/+AJIlP3iZRsgAA0a:Nb4bcdkLSNf1/+uIlP3ici
TLSH
T17CA4E0243291C037E29701380BE6DBB5523A7DA19F6268C73BD0376D6EB42E1DA3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download