91b264cdbd2c0d00fe4ea9ca271b1e6e5790499682c36365ff813d83611d35d9

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 16:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_aac3d31c605df14229353c1ba3e987e1_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260702-vcy2msfs8r
SHA256 91b264cdbd2c0d00fe4ea9ca271b1e6e5790499682c36365ff813d83611d35d9
MD5 aac3d31c605df14229353c1ba3e987e1
SHA1 bbbc737dcc7fe6f68bf88a9ac05a56d4d4a11722
SHA512 e1e8c2459a6cd8156dc7c32af0e4fa37bce5e343765be8b9800400ed036ce51457469d1b2fe5c92a94394b69c186e3e4eec45f43ba8842b03b3390d90316763b
SSDEEP 12288:9O4rfItL8HAJdmOMsuG/fzHwJEvzO675UO:9O4rQtGAJr/fcSO6VUO
TLSH
T142A4F12AB681C133D29302755BD2DBA9A63E79750326A4C33BD8037D1F65AE1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5080	50AB.tmp

Executes dropped EXE 1 IoCs

pid	Process
5080	50AB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_aac3d31c605df14229353c1ba3e987e1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50AB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5224 wrote to memory of 5080	5224	2026-07-02_aac3d31c605df14229353c1ba3e987e1_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_aac3d31c605df14229353c1ba3e987e1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_aac3d31c605df14229353c1ba3e987e1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5224
- C:\Users\Admin\AppData\Local\Temp\50AB.tmp
  "C:\Users\Admin\AppData\Local\Temp\50AB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_aac3d31c605df14229353c1ba3e987e1_elex_mafia_stealc_tofsee.exe 86DDAE5E25156F538BDB9B712E843764149243EF731D6B4B7E4682D494F230BAF66A13DAA27C98BCD0F0658CD856979B8E466EF3BC9789F60C99F8F936974A4C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50AB.tmp

Path C:\Users\Admin\AppData\Local\Temp\50AB.tmp
Size 479KB
SHA256 49a363ae827c2c51ee5873206f9a8e5540caab70a1adcec7e5a722b572f1c1d6
MD5 755d6865d4ddbae183c0bc9ce9ec02ac
SHA1 e3771703c9460a48735082431237a673b79c94d3
SHA512 cbd97b7a5b1ce5f8dc5a50a1e382b7e25164970cf6d7b26da2a5a8db845e7ce8dd36f32096271dc593426dee364e7175c8b7a65fd038bf1cb2ff1545226720bf
SSDEEP 12288:9O4rfItL8HAY0JiZg3LMMRNEaOH9o3YruK75UO:9O4rQtGApJ0g7MMRNFm8KVUO
TLSH
T1C4A4F12A7681C133D29302755BDADBAA663E7571072694C33BD8067D1F60BE1D33A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download