8e0fe2b357f004dc00ee10238402ad58d9f09523d6fb9e3811d4abc791cc286d

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_d4f1f319663a9a9354b85eaeb0704359_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260704-vs4xtsav7v
SHA256 8e0fe2b357f004dc00ee10238402ad58d9f09523d6fb9e3811d4abc791cc286d
MD5 d4f1f319663a9a9354b85eaeb0704359
SHA1 f603ba754d33c795549d501dfd73adaa3aa23067
SHA512 664cbb2754349a5199003d5e0b494c2d2c7fe614197b4fde197c280233173b46888b1d3405b926f2fbe1731be1027e089a947cecc5ff918852e95718f8522943
SSDEEP 12288:qO4rfItL8HG19Jt2oIXv1YY8WeKlNjmUuIZlW7bWmeEVGL:qO4rQtGG192oIinWeK/mUlWumeEVGL
TLSH
T1B8A4F12A76818133D2A302740BE6DBAAA63E75B1073594C77BD403BD1F656E1C37A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5624	1E6B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5624	1E6B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_d4f1f319663a9a9354b85eaeb0704359_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E6B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4324 wrote to memory of 5624	4324	2026-07-04_d4f1f319663a9a9354b85eaeb0704359_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_d4f1f319663a9a9354b85eaeb0704359_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_d4f1f319663a9a9354b85eaeb0704359_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4324
- C:\Users\Admin\AppData\Local\Temp\1E6B.tmp
  "C:\Users\Admin\AppData\Local\Temp\1E6B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-04_d4f1f319663a9a9354b85eaeb0704359_elex_mafia_stealc_tofsee.exe BCC240A19C7C1D08CBB2FFC0C93C409FBEF84E57C350BF7EB89DC8B1DE25576890ED8ABB6C829377F6B6A7E4D90B0F28DB73DBE1AEFBD0D9FFEE58BDB8949C26
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1E6B.tmp

Path C:\Users\Admin\AppData\Local\Temp\1E6B.tmp
Size 468KB
SHA256 f524b07700fc02aed8891389d750186ff2426734f9cbcf7e0171bf497e1b5484
MD5 4a4cd14ae60a9834def22918fa1fa383
SHA1 74c2a04e798c5177017d6ca7783291337406f6d9
SHA512 0026012ba6d20d84bd1906350042b226b99f5fd3f36f422bc408303a0f78a1741ad6adeba7c60ae5344dbe57c62cf446a31852b4282fd3443643c1c32660d3d2
SSDEEP 12288:qO4rfItL8HGY8ZtB/iJgwz1xLHp+vg7bWmeEVGL:qO4rQtGGY8ZthVmZHovgumeEVGL
TLSH
T19CA4F126B281C133D29312314BE6EBA6A73E75B44726A8C33BC4467D2F656D1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download