649f858ce8834150c8354507b48e2110cd6602edc50951ddcfb87b662369576d

Analysis

max time kernel
148s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_fd6d795fd1872cb23acd6902a78677a1_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260702-tgadeaet3n
SHA256 649f858ce8834150c8354507b48e2110cd6602edc50951ddcfb87b662369576d
MD5 fd6d795fd1872cb23acd6902a78677a1
SHA1 eba9787afceac71c6bba721d62981e8341d44c9b
SHA512 2f77104e67c46a5030d24b579e4b97680378fb2cb91cb8bf2c988807f5204fbad5706ff5b05bbda91e2bf47b21b4da82d85427d5ace21d720eff3ae4470c0e04
SSDEEP 12288:Nb4bZudi79L1EZYV9N5NkRcnHlxWYf8gA0a:Nb4bcdkLw2fZniY8
TLSH
T12BA4DF253182C037E2A701394BE6C7B5653A7D614F3168CB3B947BAE6EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5060	CADD.tmp

Executes dropped EXE 1 IoCs

pid	Process
5060	CADD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_fd6d795fd1872cb23acd6902a78677a1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CADD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 5060	5992	2026-07-02_fd6d795fd1872cb23acd6902a78677a1_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_fd6d795fd1872cb23acd6902a78677a1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_fd6d795fd1872cb23acd6902a78677a1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Users\Admin\AppData\Local\Temp\CADD.tmp
  "C:\Users\Admin\AppData\Local\Temp\CADD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_fd6d795fd1872cb23acd6902a78677a1_elex_mafia_stealc_tofsee.exe A76B32AE2D0DD6CA58A6BA58E18736378F7AEE330CC9DF5860788FD76E2FBD01CB4B166AD2759398A53654CB8B24A90050E5E89E1DF9DA7DA4FF5671F53512AC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5060

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CADD.tmp

Path C:\Users\Admin\AppData\Local\Temp\CADD.tmp
Size 473KB
SHA256 317347414edcff9a81e2a44c321cf9eb900ebe9edc16471b6197e41cda52fa06
MD5 fa2ea88a9df0ebe7ab8bb5e5b74eeeb9
SHA1 48300544b6577c0d47b399393c5fc5077fe3dddf
SHA512 c1d8483e4812e4e7a60077837ce57d6cf6c0d3e127637aa63d5b9690a020c37a317682170670d2371530deaf04f3c6a0cb20d245c47a1d216897d067d8fa8ae9
SSDEEP 12288:Nb4bZudi79LrGFBrx6rU92D4OSMaCoFclmsA0a:Nb4bcdkL6D92D47VCG
TLSH
T184A4E0207681C033D2A716394AF6C7B5653A7CA04F66A8CB3BD4376D6EB06E1DA35307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download