9b3df9e8c2df9da1d65e351c406d448e55ca0f01beb02f92fcccd0e966920bc3

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_ce9ea87296d81fcfc553d5cb686c8b1c_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260702-ryxtxsds6l
SHA256 9b3df9e8c2df9da1d65e351c406d448e55ca0f01beb02f92fcccd0e966920bc3
MD5 ce9ea87296d81fcfc553d5cb686c8b1c
SHA1 cef02413318e36c223905c209db7b3cc86e8432c
SHA512 2a008ad6b2a1f0ae50bd178a4febacd3ac4d78c31239097012a023e0a4da9d8424485fcf0d2328f25edffb8eae93064a0d58c11e96991e48f13b731113b11143
SSDEEP 12288:Nb4bZudi79LJPf0s670W1v8QGPkZT8d+Rvz6A:Nb4bcdkLit7FC8pn
TLSH
T1A7A4F1243286C033E19716384BF5CB76763A79A15B66A8C73BD42BAD2FB02D1D630357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4636	DC80.tmp

Executes dropped EXE 1 IoCs

pid	Process
4636	DC80.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_ce9ea87296d81fcfc553d5cb686c8b1c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DC80.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 8 wrote to memory of 4636	8	2026-07-02_ce9ea87296d81fcfc553d5cb686c8b1c_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_ce9ea87296d81fcfc553d5cb686c8b1c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_ce9ea87296d81fcfc553d5cb686c8b1c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:8
- C:\Users\Admin\AppData\Local\Temp\DC80.tmp
  "C:\Users\Admin\AppData\Local\Temp\DC80.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_ce9ea87296d81fcfc553d5cb686c8b1c_elex_mafia_stealc_tofsee.exe 035DC309E0976D7F8E77D188BEB46E30F1B927EC178E6B939D1D28C24C7C082109C0AFA4C90F759993FDB9D5648624E83639A8F54F1187769F56A0D19798DBF5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DC80.tmp

Path C:\Users\Admin\AppData\Local\Temp\DC80.tmp
Size 444KB
SHA256 a00c970b62af592fad093bb7a77fef9609467170808d4fd97325e83d52b2f536
MD5 2dd0cfc43afebf03199b8aaa9e5a8b5e
SHA1 a878542d71314f704c04167327c149b5d9a333a2
SHA512 e3bdc57606f00ce09026a2497429f7caa9c0d8bd0dbf37b0a418c5513afb5f4ff34036f87e1ab24277bcf1897602076498694c896107ba57ac1e294fa46c687f
SSDEEP 12288:Nb4bZudi79LjvUt0PWTz3oqPMTzOKrWsS4w2aA:Nb4bcdkLLUZTzYihd2
TLSH
T171A4F0243582C037E26316384BE6CB76657A7CB14B2668CB3BD45BBD5EB02E1E634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download