8d545d2c69c36dabe37dd6e2bac29369f36cfefff52f89aed356c317a0097588

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 08:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_869834633e612112f7aee195cedd0599_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260704-kah8asc16w
SHA256 8d545d2c69c36dabe37dd6e2bac29369f36cfefff52f89aed356c317a0097588
MD5 869834633e612112f7aee195cedd0599
SHA1 c1dc84085fec8792a8c00267798f5cec13c1bf92
SHA512 97a5c21bd036d280a49bd929527ff063ef9e6b45d6ddb363f6e3c76bfbee9b6ea341d3d53ac17f47c88a7eac09a77b9fbdd57fbb7ab7a11156887bc3cbe1870e
SSDEEP 12288:fd4x+ePixnXQjrz+t3oSItxx4n0r3A8pXxawP:fd4x+ePixAj3+YSItYKa
TLSH
T1BB94E0203282C036E1A606388BF5D7A9593D7DB44B72A4C737D42BAE6F642D1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5860	7162.tmp

Executes dropped EXE 1 IoCs

pid	Process
5860	7162.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_869834633e612112f7aee195cedd0599_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7162.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5812 wrote to memory of 5860	5812	2026-07-04_869834633e612112f7aee195cedd0599_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-04_869834633e612112f7aee195cedd0599_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_869834633e612112f7aee195cedd0599_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5812
- C:\Users\Admin\AppData\Local\Temp\7162.tmp
  "C:\Users\Admin\AppData\Local\Temp\7162.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-04_869834633e612112f7aee195cedd0599_elex_mafia_stealc_tofsee.exe 574590D0C6F4164C6D13CAC2D17C3A2BBBBCEBD193A554E26AAC89AAA0114EBE8F7CB737C271BD1816009D3B4C6C11A46932BD286C5252D2D57ABBB42D1B9407
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7162.tmp

Path C:\Users\Admin\AppData\Local\Temp\7162.tmp
Size 435KB
SHA256 009ae2066383182281544a7d04d9a48fb30edc70ad0bb5dc65e37eaf00661026
MD5 41334fb27ee87932bad53ffd6542e829
SHA1 469da8994e7579c37bff2dc83eef273ce0a984e9
SHA512 b47923f242f170685fb6c479ad6349c5d3e2a9610e4433f49f0427b1f27dd9b11284bf5863250a2cd80cb194bfbadde856304764cdb8f704a19c682fa360ad2d
SSDEEP 12288:fd4x+ePixnXQjmUwZoE5IycgGbB+/1BAR5wP:fd4x+ePixAjmUU1Iyc2s5
TLSH
T10494E1213582C037E1E705354BE5CAAA697ABDB10736A4C73BD027AE6E742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download