223617c09bbfd8f63f947cc2a08fdc0c8c9b4fbc57740998b04570732704890e

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_a84d593b2ae8bd1d3658f0bd4ccb7b2a_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260710-13877aex4z
SHA256 223617c09bbfd8f63f947cc2a08fdc0c8c9b4fbc57740998b04570732704890e
MD5 a84d593b2ae8bd1d3658f0bd4ccb7b2a
SHA1 719139d2cdd7f223637afcef22fd62fedfe5b4c5
SHA512 de91ab364225a4dea9512fd31b305767f312ecb0102bcb9d087d4e1a522e8b44ba7a5b2c0e17eabefac809eb910bf342daf8806497ca4a9e9c58f00ac61a722c
SSDEEP 12288:Ci4g+yU+0pAiv+BECiN93q/WlzHE+EfCY5n:Ci4gXn0pD+uUAjAfCE
TLSH
T1ED94F1303592C033E19715350BE5CB6A29BE75A64B21B4CB7BD41BBE6EA03D1D63438B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1240	E0F5.tmp

Executes dropped EXE 1 IoCs

pid	Process
1240	E0F5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_a84d593b2ae8bd1d3658f0bd4ccb7b2a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E0F5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3380 wrote to memory of 1240	3380	2026-07-10_a84d593b2ae8bd1d3658f0bd4ccb7b2a_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-10_a84d593b2ae8bd1d3658f0bd4ccb7b2a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_a84d593b2ae8bd1d3658f0bd4ccb7b2a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3380
- C:\Users\Admin\AppData\Local\Temp\E0F5.tmp
  "C:\Users\Admin\AppData\Local\Temp\E0F5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-10_a84d593b2ae8bd1d3658f0bd4ccb7b2a_elex_mafia_stealc_tofsee.exe 5FBB6F2F0CC90A84E0451473B27D1DD4A08C289F8C796356B591026B8630485A8F2F428929A7CF325BB28166E291128B0633FD3743BA37AD95C036C8A86C3B76
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E0F5.tmp

Path C:\Users\Admin\AppData\Local\Temp\E0F5.tmp
Size 433KB
SHA256 6430f06d1e5b019ace9a90c3997735aa5efea3686bd752adc10e1cf5a2d42587
MD5 a60cc7d5be3acd0cf7ac672bdc637070
SHA1 dce9bd70d393a92667436666e887f9a6130ed8e2
SHA512 adff61cbe95f0bd7a6ed00456613c98bb05381cc229962f44281a4fca2f9fc1d3493a1f259bc453be34a445494fcb1e30dcb7bdffa2344c2536022087095a5fe
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvz//Y2hpDG+xW1rvjv5gxqGmTW2CVMpCv+CN:Ci4g+yU+0pAiv+G2G+Nq78Mpo+C5aIn
TLSH
T11894E0313542C033E29715344BE5DB6A267E75B64B26A8CB3BD41BB92EA03D2E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download