39f77aa6a8248385b6c1562fb7dee353c77b257a856691693cd83d11b35d4f19

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/07/2026, 04:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-08_3718d7572c0fbc91fe66c15cd5385008_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260708-fer9jsa14y
SHA256 39f77aa6a8248385b6c1562fb7dee353c77b257a856691693cd83d11b35d4f19
MD5 3718d7572c0fbc91fe66c15cd5385008
SHA1 09f34b53ec8350bdfeba5fc1fa5e4c4e2d7d6a4a
SHA512 40590f1ba501b9b6b0eff2ef749f5f9866655ced617199127ec1b689bcf4fb17ec61ab55f12a65c889931c61412e9608a0daaadec88359722e61c877c7dc9913
SSDEEP 12288:Wq4w/ekieZgU6VcuZBVaBafffSp2oZIulx:Wq4w/ekieH6VfBwBaHiFr
TLSH
T12094E0303586C036E6AB06358BE1DB69593A7E610B75A8C73BD427BE6E342D1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3252	4FDB.tmp

Executes dropped EXE 1 IoCs

pid	Process
3252	4FDB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-08_3718d7572c0fbc91fe66c15cd5385008_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4FDB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5880 wrote to memory of 3252	5880	2026-07-08_3718d7572c0fbc91fe66c15cd5385008_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-08_3718d7572c0fbc91fe66c15cd5385008_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-08_3718d7572c0fbc91fe66c15cd5385008_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5880
- C:\Users\Admin\AppData\Local\Temp\4FDB.tmp
  "C:\Users\Admin\AppData\Local\Temp\4FDB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-08_3718d7572c0fbc91fe66c15cd5385008_elex_mafia_stealc_tofsee.exe 15D4FE85DBAB96B82AEEB17D588C0614AD5535D90E4BDF51CF656710A644D3E9C0A9096D8667461AA3B4AFE4849FCCB04890A3BB4203301601AD7E4E904FC31A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4FDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\4FDB.tmp
Size 414KB
SHA256 566891d5e26ef956a7ed4dbcef591440bf14d8f0ad9eae3871aaad97cc1e6c2a
MD5 093598c0843fc9ebd1be4fb0e9bebbc7
SHA1 aa5cdec1faa0babfa3b54bc096e48652e5a2f263
SHA512 4acb30eb969b85fcc65bf26eee24f5237f0d168dfdb65ca85f6fdd7a9cb36754aaed97b5e8b8b5470c042576d5a8878ae8f9730abe2f4a4ff1950fc0d64dfd42
SSDEEP 12288:Wq4w/ekieZgU66wrL7AUg0KnhockXx8lx:Wq4w/ekieH66wrvC0KqD8r
TLSH
T14E94E0213186C037E1A709348AF6CBBA5A3A7E645B31A4C73BD41BAE5E746D1DB30347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download