3456d72d66a41ffde69a3721d821d78a4f6010c3897af2f81f1b20c3762c7d55

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_aa3b341f5badff4b98647778994d7e39_elex_mafia_stealc_tofsee.exe
Size 499KB
Sample260702-vc161afs9k
SHA256 3456d72d66a41ffde69a3721d821d78a4f6010c3897af2f81f1b20c3762c7d55
MD5 aa3b341f5badff4b98647778994d7e39
SHA1 c16ae2ae02e532fb346c5a3b1c01d52d32128508
SHA512 dca27e021a31a3e03fa4eb06faa45fd3749b8ee284e7f83f9648a4a693ae4169f007af6b3d6c0c2db61c98044eda44a492d9c77cda4246b977c5bc1123b1286c
SSDEEP 12288:sO4rfItL8HPfCGFAXUbXRUz/Vy4kXN7dmsIhiqlj:sO4rQtGPvezVy4iNAsIhiqlj
TLSH
T16FB4F12A76818133D2D302352BD6EA9ABB3F75751326D4C337D4026D1F62AE1D73A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
812	B3CA.tmp

Executes dropped EXE 1 IoCs

pid	Process
812	B3CA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_aa3b341f5badff4b98647778994d7e39_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B3CA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 812	5696	2026-07-02_aa3b341f5badff4b98647778994d7e39_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_aa3b341f5badff4b98647778994d7e39_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_aa3b341f5badff4b98647778994d7e39_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Users\Admin\AppData\Local\Temp\B3CA.tmp
  "C:\Users\Admin\AppData\Local\Temp\B3CA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_aa3b341f5badff4b98647778994d7e39_elex_mafia_stealc_tofsee.exe 76C4F83634344462B7DEA6B8DFD6DB87338CF7FFC247823E5699B2C6677DBB88113D3504E48E25BC33A38FBEBECA81F27591E45AF2C667FB92E4F4D4C1B129A1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B3CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\B3CA.tmp
Size 499KB
SHA256 f2244dd4168562f1ab196d51de589fbb2ba267dfd5722a6a23d0837dfbe997ba
MD5 d3aaa2da90d8ceb113deeb40407e7b16
SHA1 08b9a9958630d1bf436f1256e3c9ea74427e5553
SHA512 b2d9ba6b22b1ca564986a1a0cba80c2124e32a84e6f282d679a69ffa54ee565f05a96b154fe882b33e0f4b5649dd454f4337f0e8a0f898e56572a3ff32e88eaf
SSDEEP 12288:sO4rfItL8HPjulYIAyOVWcfNCmztV7dmsIhiqlj:sO4rQtGPjulvA9VtNdVAsIhiqlj
TLSH
T19EB4E12A77418233D2D312715BDAEB9AB63E74B50326A4D337D4027D1F62AE1D339386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download