918ae53b01ca1252c8d17ee1faf69ef83e11f0d21106f8a0698bb3cc20e601ba

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 21:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_f7b62b413e1e7047196a0f8d76031a0a_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260710-1kt1jsdw4s
SHA256 918ae53b01ca1252c8d17ee1faf69ef83e11f0d21106f8a0698bb3cc20e601ba
MD5 f7b62b413e1e7047196a0f8d76031a0a
SHA1 6e26504e82c5cca2493047acc594386f6e1f547c
SHA512 c218bf7868b50a99e740866583a70f03734a282f2949411f37a28c497936bd763ac8ec8a1bfaa5ccea0b16e889441444f2e30b2b4bd6667b878d3a1ea7db27f7
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStqCvSroq2RK4X4dxStiAMrW92nVfhaA2D5iQ:Nb4bZudi79LmvIXQKM4jSt1cnaEh7xA
TLSH
T10FA4F1203082C037D2A716384BF6DB76657E79A14B2268CB3BD46B7E1EB42E1D635317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3472	42CC.tmp

Executes dropped EXE 1 IoCs

pid	Process
3472	42CC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_f7b62b413e1e7047196a0f8d76031a0a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	42CC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4380 wrote to memory of 3472	4380	2026-07-10_f7b62b413e1e7047196a0f8d76031a0a_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_f7b62b413e1e7047196a0f8d76031a0a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_f7b62b413e1e7047196a0f8d76031a0a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4380
- C:\Users\Admin\AppData\Local\Temp\42CC.tmp
  "C:\Users\Admin\AppData\Local\Temp\42CC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-10_f7b62b413e1e7047196a0f8d76031a0a_elex_mafia_stealc_tofsee.exe DAAE8FC52E0242C1782D11FF9FE7CF1A17F4F37684BCB09C872AFE592A8601BD8E1C526BD02DC7033BC511739B1BFB80FC40FF292B98F2D761E2F150C8F33963
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

42CC.tmp

Path C:\Users\Admin\AppData\Local\Temp\42CC.tmp
Size 444KB
SHA256 6824c3e211f2e17588e2d45f5da2ad285bf26bef8a05ff625b6bc9243d3d156e
MD5 f09e1564dd8648cd08ea818d7d4c5b7f
SHA1 689a908c09c4afd36f74bcf184fca0d031c6a491
SHA512 82218002e0b091596ca01703f4903f7b0af7d83a0822e33faede49db519943bf908e73d59586c483c6fa6942dc2171525eadcba2c23fcca6f22f26c964846bf3
SSDEEP 12288:Nb4bZudi79L61OiFwqi2clHqNPehgbIAdnA:Nb4bcdkLIOiFk2qKNPehg5
TLSH
T1E9A4F1343581C037E2A715344AF6CB755A3E39A18B2268C73BD46BAD6EB03E1DA31357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download