905ba8d1be681fa55c805f466073ed6094d0ce73214d92c040773de7bd22600b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_e7db4518f9d71fd80b0a6abd40a59888_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260702-rs4qaac15l
SHA256 905ba8d1be681fa55c805f466073ed6094d0ce73214d92c040773de7bd22600b
MD5 e7db4518f9d71fd80b0a6abd40a59888
SHA1 db818aa5c1903ecad1d4961c60fd6b15e0ad94b2
SHA512 c12a266ad68092aceeab97fce78abe8bdbededb049225aa397ec7c1fb6dbd0e5900aa4c0a480df6bf08be63d1793c73f5bb462dd3307ccf107b2531209061295
SSDEEP 12288:aO4rfItL8HRmnntBjC6r3U0RCoJClH7K9wlsDpVFd:aO4rQtGRmnW6r3UaCoJCN+9wlsDpVFd
TLSH
T1CFA4F1293682C233D29302715BE6DBE6B63E78751366A8C33BD4022D1F616E1D77934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1344	7B07.tmp

Executes dropped EXE 1 IoCs

pid	Process
1344	7B07.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_e7db4518f9d71fd80b0a6abd40a59888_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7B07.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6016 wrote to memory of 1344	6016	2026-07-02_e7db4518f9d71fd80b0a6abd40a59888_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_e7db4518f9d71fd80b0a6abd40a59888_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e7db4518f9d71fd80b0a6abd40a59888_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6016
- C:\Users\Admin\AppData\Local\Temp\7B07.tmp
  "C:\Users\Admin\AppData\Local\Temp\7B07.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_e7db4518f9d71fd80b0a6abd40a59888_elex_mafia_stealc_tofsee.exe A3677B9DD07C24E31A7E6BE69798D7DE2CB582CC485A5D3F02C9E26F3B8BDDBE4E2622455F7418E107FE47A337E3B0538FBC681437EB87E9760A87B1B9E2AA59
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7B07.tmp

Path C:\Users\Admin\AppData\Local\Temp\7B07.tmp
Size 476KB
SHA256 c72f7f4518d5517797b4994be3f948644cae93379736c0c19fd288aba280cf26
MD5 695a22c17033b29a05112f175c27b1f6
SHA1 af47309d6ec97b43b60e68d5086a02b4e41168ff
SHA512 6f9926c6e29441028247d21bdd324bf39cde7e74b025e521f2fa687991e520d8e760088fa760895f6d5233d49301cf0a6f8d9fe61abfd09805f3fab06fd53958
SSDEEP 12288:aO4rfItL8HRDnzTWxYOf25kYi1gabr0Q8ZioV7K9wlsDpVFd:aO4rQtGRDzTUYOf+YLSZrV+9wlsDpVFd
TLSH
T117A4E13AB6818133E28302300BE6D79AA63E79755765A0C33BD4027E1F65BE1D776347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download