dd6f623e90b94d6ff6e96907cd861c7d70a2b2fc5a5f14a2d1ecadc03ad0d99f

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 13:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_85f4d7b1b6719e2f28355252e5e99a3a_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260704-qscfcsbx2m
SHA256 dd6f623e90b94d6ff6e96907cd861c7d70a2b2fc5a5f14a2d1ecadc03ad0d99f
MD5 85f4d7b1b6719e2f28355252e5e99a3a
SHA1 cf0a0964a24d94b0db191306a0c61d203c603282
SHA512 14fb017d293db9e1a4f32f0a311e3e8b45257b0f4b44eba543765129947ac23ca034a8d6979b7b2e22617772091f8cffec5a6058f828a8ce3b10842396d88563
SSDEEP 12288:qO4rfItL8HGS7wXngz5EXansKXNR3syrj0g77bWmeEVGL:qO4rQtGGS7oOEKpXD8yrjD7umeEVGL
TLSH
T15AA4E13AB641C133D29302750BDAD7AAB63E75B14326A4C33BD8427E1EA17D1D37538A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5984	ED78.tmp

Executes dropped EXE 1 IoCs

pid	Process
5984	ED78.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_85f4d7b1b6719e2f28355252e5e99a3a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ED78.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5904 wrote to memory of 5984	5904	2026-07-04_85f4d7b1b6719e2f28355252e5e99a3a_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_85f4d7b1b6719e2f28355252e5e99a3a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_85f4d7b1b6719e2f28355252e5e99a3a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5904
- C:\Users\Admin\AppData\Local\Temp\ED78.tmp
  "C:\Users\Admin\AppData\Local\Temp\ED78.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-04_85f4d7b1b6719e2f28355252e5e99a3a_elex_mafia_stealc_tofsee.exe 12C936F3AB28092812B7811ADFE58358BBC1341B890DDE91810952A088B11775225B7885112FEDB059A5DAECC49DDD05BDF53EC382DA066D74ABB6E3906E694F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

ED78.tmp

Path C:\Users\Admin\AppData\Local\Temp\ED78.tmp
Size 468KB
SHA256 bc764989f935b95ecb5dacbc52b571a75520842717a038583fc9ddd40dc6e072
MD5 23b4483c1b98dfd3ea2ab36df6ccb24c
SHA1 72b2a83a24ef00a8b7c9930f2b101e023ef69d6b
SHA512 78c9132ecccfea69c513c375651260d00279d2d99ebbb8296827e5fefaecd7923ab55add45cac9e554bfe135a3226ab725a66804b81a990b33b83997e74d8a50
SSDEEP 12288:qO4rfItL8HGz+w684gIbyTG9xC7bWmeEVGL:qO4rQtGGF6tgG+G6umeEVGL
TLSH
T19AA4F1367641C033D2D312355BEADBAABA3E75B40362A4C33B9406BE5E616E1D339347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download