12049b0d8ca9650ce687af0b39b30cf10beb071342145b0f63adc91042301962

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/07/2026, 16:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-09_e754ee035c783e0fb48d82aee2f95e66_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260709-tpblfads4n
SHA256 12049b0d8ca9650ce687af0b39b30cf10beb071342145b0f63adc91042301962
MD5 e754ee035c783e0fb48d82aee2f95e66
SHA1 f7231b28fc6e67e812654350477c55f44b874d26
SHA512 af83b5c030c7fb8143ae999f2c72c7e765707b98f03224e64778517aa313a5869ae999c81873f321a730473166eff8ba2e11e8daaa7bf18cbb583e41c425600e
SSDEEP 12288:qO4rfItL8HGOj+ls8bxGwZZw24hec7bWmeEVGL:qO4rQtGGjxtP4gcumeEVGL
TLSH
T1A5A4E03A7641C133D19302751BEAEBAABA3E79B00726A4C33BD4027D1E656D1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
860	F41F.tmp

Executes dropped EXE 1 IoCs

pid	Process
860	F41F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-09_e754ee035c783e0fb48d82aee2f95e66_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F41F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 860	4532	2026-07-09_e754ee035c783e0fb48d82aee2f95e66_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-09_e754ee035c783e0fb48d82aee2f95e66_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-09_e754ee035c783e0fb48d82aee2f95e66_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\F41F.tmp
  "C:\Users\Admin\AppData\Local\Temp\F41F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-09_e754ee035c783e0fb48d82aee2f95e66_elex_mafia_stealc_tofsee.exe DD84C07FFCDDDFBD1834ABA1034880820E71B8AB5F7DFBAEB07217D53A2331FD034E5774E721BB068BE23C21072ED72CE1F35BD8857DFB476CC2672FA4EFCE81
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F41F.tmp

Path C:\Users\Admin\AppData\Local\Temp\F41F.tmp
Size 468KB
SHA256 c7e55d67ef315c041c0372dd6965dd100b9bec16b7b40f5f8a5ab7a6da17b082
MD5 7a0ec2350fefc2eff1913f8d77cada9d
SHA1 5682739abf047de92a419cc9ac56c6c794814d4f
SHA512 b16ee6feaf4e092117a17d257ceb39f01ee391734701cd3f1e1c9724bb64a5f29cd11e4e77ff76bffcab2c32b0aa54c368c2b985400f1a61eac92a75b50e06e3
SSDEEP 12288:qO4rfItL8HGha4Dlk3+Icuf2Y13SBlTxmTSbTuW7bWmeEVGL:qO4rQtGGsJOInNC/xA8TuWumeEVGL
TLSH
T177A4E02A76818133D69302750BE6DBA9A63E75B40732A4C33BD402BD1F756E1D37A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download