bda01862dc725ed1eb5fdbb9973dd1e98d11270acfc7d016b59024d5bc9f373a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_90ecbff482f9893e7a93a2aae45f94e7_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260702-vmkl1aat9w
SHA256 bda01862dc725ed1eb5fdbb9973dd1e98d11270acfc7d016b59024d5bc9f373a
MD5 90ecbff482f9893e7a93a2aae45f94e7
SHA1 ba67ea7a58393254180960b6f34dfb7e6aa0cec1
SHA512 b1a521b7f46150c5b469f5de0c6ed173a912e1da174ceb96f555b884884f82f3a4aa2155337ebc30212c4010d7f00d51e845b442fe87be11f1c6e20a37de1f3e
SSDEEP 12288:Ci4g+yU+0pAiv+VbrobQPCNo79Mz5we8n:Ci4gXn0pD+WbbNo79jes
TLSH
T1DE94F1243592C033E6A719344BF5CBA6657E75B60726B8CB27D40BBE2FA42C1D238357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
752	F0C4.tmp

Executes dropped EXE 1 IoCs

pid	Process
752	F0C4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_90ecbff482f9893e7a93a2aae45f94e7_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0C4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 752	1056	2026-07-02_90ecbff482f9893e7a93a2aae45f94e7_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_90ecbff482f9893e7a93a2aae45f94e7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_90ecbff482f9893e7a93a2aae45f94e7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\F0C4.tmp
  "C:\Users\Admin\AppData\Local\Temp\F0C4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_90ecbff482f9893e7a93a2aae45f94e7_elex_mafia_stealc_tofsee.exe 901F58E5FC4F59FB883E4B6EFEA9865717DE6F453E308BCBA880C3B6C91AE93BD76A3E6EB67EEF092B914829CD44D82EEEB5428E5A1A68754804B79AFB4F4984
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F0C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\F0C4.tmp
Size 433KB
SHA256 59cf77267e0ca1b3ffb0fffd5e94bd89dd5c94eefae368cddf6c7904f80a0559
MD5 c554b9803f74ab6d75354798edc8aca0
SHA1 85c3df7a20bab8f6ba8619862bdb601455b2e43f
SHA512 254cd8b6b305b8b26eee19452ad759b9f80ce782048ab3cc10845dde5a96d7a44949d396c935de20d4266ee5d08332b7cedc4bb8c81b5dc72fbb9980afb8e5c2
SSDEEP 12288:Ci4g+yU+0pAiv+/85qxy+fNyFfQzp0KNtdn:Ci4gXn0pD+0Mg+fNyRQzp0KNtF
TLSH
T14094F0313581C033E1961A384BF5DB9666BE79A50B22A8CB7BD41B6E6FA03D1D334347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download