479784c3632b14eeaa1838d0f3e5f7eac66bdf9d50511c0c673ddfa02c55e1ed

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 18:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_306c8a6c79f9aa37e42a8803b591a1bd_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260702-wmax8sgv5j
SHA256 479784c3632b14eeaa1838d0f3e5f7eac66bdf9d50511c0c673ddfa02c55e1ed
MD5 306c8a6c79f9aa37e42a8803b591a1bd
SHA1 ae03707bdc48ab548eb43be42c2ec5250c394433
SHA512 ac32f1240795a639a4229b8bc7974f0e3f8144b467ff28cbc98afe18b7c3b274c0fe9e09c5653093488fc4897f4b77c1507c4aa55debf856c107c30f73d489ab
SSDEEP 12288:Nb4bZudi79LAZKn6EeuNR6ASUX7+NkXCtMJjK1TA:Nb4bcdkL29EeuNR3x7+wCC
TLSH
T15EA4F1343181C033E29715784AF5CBA6257A39B14B21A8C73BD46BAD2FB42D2E778357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4712	891.tmp

Executes dropped EXE 1 IoCs

pid	Process
4712	891.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_306c8a6c79f9aa37e42a8803b591a1bd_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	891.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6032 wrote to memory of 4712	6032	2026-07-02_306c8a6c79f9aa37e42a8803b591a1bd_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_306c8a6c79f9aa37e42a8803b591a1bd_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_306c8a6c79f9aa37e42a8803b591a1bd_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6032
- C:\Users\Admin\AppData\Local\Temp\891.tmp
  "C:\Users\Admin\AppData\Local\Temp\891.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_306c8a6c79f9aa37e42a8803b591a1bd_elex_mafia_stealc_tofsee.exe BD417103FFB1645C23E4BF6A530D2080EC4CC88135BBE450AB66EE0C9CC7B29E6680880FF97EF86BB0CBD54A527559C3E232A522FC15BC0F25A9AB1C5843E1D5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

891.tmp

Path C:\Users\Admin\AppData\Local\Temp\891.tmp
Size 444KB
SHA256 fc30f882d38072fedbb87df8b44837695a7103a57954f90d0ab08b5945ef9223
MD5 b23749f895c12d5dd1c0e75c884a6239
SHA1 d9b029d668ba8a5a2c1d1cbff2b4494d598aadf5
SHA512 18828ba4ef60c5971bb3401593d9c9440352b62d1f536e2e9285e65ef0ad3a0dceaa4265e77bdce0191f55f40ec04453d31f5a865632dfbed491dde1342d47c9
SSDEEP 12288:Nb4bZudi79LHDC8aa7mhIrkSjZBmT5Y0EwlUA:Nb4bcdkLHDC++gkOZB6l
TLSH
T1DFA4F2293582C033E29705354BE6CB36AA3E79B14B2668C737D41BAD5EB43D1E674307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download