f40d58a9b6be4b50d83182b7dc5e2f46bbb70d8034791a1848cc967fc89df617

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 18:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_247eea1691a2e1ca1e8ed1d22140fcc2_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260702-wrerzsbv71
SHA256 f40d58a9b6be4b50d83182b7dc5e2f46bbb70d8034791a1848cc967fc89df617
MD5 247eea1691a2e1ca1e8ed1d22140fcc2
SHA1 7120d3bf49f530fd544c8949634ad999fbc2977f
SHA512 4d39a446a76d43e89a605374c88d9fa29d1837bb06114ca19ab1311d09c8b0c7b4425b32e836d95fed38deed28f0f64353a0a5a27366c9c829aa5a5229b97ab2
SSDEEP 12288:bO4rfItL8HAT36rLE4G+A2v9EuKNDCx9O575UO:bO4rQtGAT3sNGaGMuVUO
TLSH
T1ADA4F12A7681C133E3A302755BD6E7AABB3A7471072694C337E4067D1F646E1D33A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5144	9788.tmp

Executes dropped EXE 1 IoCs

pid	Process
5144	9788.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_247eea1691a2e1ca1e8ed1d22140fcc2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9788.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6084 wrote to memory of 5144	6084	2026-07-02_247eea1691a2e1ca1e8ed1d22140fcc2_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_247eea1691a2e1ca1e8ed1d22140fcc2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_247eea1691a2e1ca1e8ed1d22140fcc2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6084
- C:\Users\Admin\AppData\Local\Temp\9788.tmp
  "C:\Users\Admin\AppData\Local\Temp\9788.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_247eea1691a2e1ca1e8ed1d22140fcc2_elex_mafia_stealc_tofsee.exe 444506F5CBD4054C1DBB13CB872CDEC8346DDFF856E2951A1987156ABCEABBC8F1CEC610900A2B2D1FC2C12265905B7E9FA878ED51E52E5E74AD366CABDF7CAF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9788.tmp

Path C:\Users\Admin\AppData\Local\Temp\9788.tmp
Size 479KB
SHA256 bf3bb65e345560a8286eb75a1037efed9bc54863bc1b48c39d5c146305336a39
MD5 54fa6aabb70c4d2479e9277eac58b895
SHA1 53b5a251a065544062d21287070c69b5aa9ec9d6
SHA512 05fde330184543c2c24a355c9c1fc70c6b8aac55040f698f2637497f2c2aba58098c172cbb26799a0119a71b97ce66203aebeb2d3dfdcd3d4835df46c35564f4
SSDEEP 12288:bO4rfItL8HA4bfjEUJHu2GFvPlVPn1775UO:bO4rQtGA4bw1rVZVUO
TLSH
T1CFA4F13A76418133D29302714BE6DB9AB63E79B41726A4C37B98033D2FA16E1D736347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download