d0b9ce92f1425b5be653203cc18741e2fd98a5bbce08eaddec6540495e82c171

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_d22a86ceb760356fb3d6d5b4ec78334f_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260704-vvfm1set5p
SHA256 d0b9ce92f1425b5be653203cc18741e2fd98a5bbce08eaddec6540495e82c171
MD5 d22a86ceb760356fb3d6d5b4ec78334f
SHA1 2faa4969ff04f44fceb3f240ff48fd7ca4bb6d71
SHA512 ca19db3b2eec569752bee0a30dc1115a4e48249d76d89b0cbc099fdd57cf1318f85397d84d052eaf19dde977227af985c2d7dab48c4a577a65dad9d5c3571b20
SSDEEP 12288:bO4rfItL8HAgYNkQJL59bjzmXs2Mom/U75UO:bO4rQtGAJ6QV3zmXdMbUVUO
TLSH
T1F7A4F12A7680C133D29302355BE6D79A7A3E39B41326A4C37BD4067E1FA17E1D73A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5608	4F44.tmp

Executes dropped EXE 1 IoCs

pid	Process
5608	4F44.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_d22a86ceb760356fb3d6d5b4ec78334f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4F44.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2092 wrote to memory of 5608	2092	2026-07-04_d22a86ceb760356fb3d6d5b4ec78334f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-04_d22a86ceb760356fb3d6d5b4ec78334f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_d22a86ceb760356fb3d6d5b4ec78334f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092
- C:\Users\Admin\AppData\Local\Temp\4F44.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F44.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-04_d22a86ceb760356fb3d6d5b4ec78334f_elex_mafia_stealc_tofsee.exe 50C1555A6BA80D09E3D97E02B008C08D991E223A042DBF0277DA91AF009D38C5C1BDB16C4F619643E87FD109230671491F8A3222E2436E014DE81F098D83CE0E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4F44.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F44.tmp
Size 479KB
SHA256 2c57c7053254dcf4854d18ac2840ce1dd497a8cfa428ef0a67049787e2bef82a
MD5 eed604ca9a4862df997dc5f710685bb6
SHA1 71e3f51a3a9e0e28fcbe498ec85da5c6e6efc906
SHA512 8c88245dd5f65cc67776fd4c06354e119f2b9112838e542f06345f107b0fcef604f48bb3129b0d3891322ea6fd3ec8f5abdb1090fef5e84289b8e3de0fe4902b
SSDEEP 12288:bO4rfItL8HAEvt1TDsiNnMzZCF5srDObTBHu/b2vdQ+75UO:bO4rQtGAm13seMkFCwTY/b2PVUO
TLSH
T1B5A4F13AB681C033D29302355BD6A7A6763E75B41335A8C33B98067D1FA1AE1D77630B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download