42ab53e4fd9659253e72401bddf076a7cd1a127cb57221172ba4d8f2ab18b97b

Analysis

max time kernel
150s
max time network
121s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_81345a2255bd3a3a1e1af109fb62c218_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260710-2c1c2acy2l
SHA256 42ab53e4fd9659253e72401bddf076a7cd1a127cb57221172ba4d8f2ab18b97b
MD5 81345a2255bd3a3a1e1af109fb62c218
SHA1 bdd37146437bc8ca90beb2ed70249c4c35ccd1b0
SHA512 01623898a572322b1f3c3d36c6e5b1976f9fc3a614c2b1b310448599dfd08999f25302505d570531fb797bb1689913b61d53857fe5f3ee830c5995848a942ce9
SSDEEP 12288:qO4rfItL8HGq4maoHMXV0Tc8a+CCgeJBPSc3ctA7bWmeEVGL:qO4rQtGGqYoHMXVrUjTJBawJumeEVGL
TLSH
T11BA4F126B681C233D28302750BE7D7AAA63E7975471694C33BC8027D1EB66D1D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4600	3186.tmp

Executes dropped EXE 1 IoCs

pid	Process
4600	3186.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_81345a2255bd3a3a1e1af109fb62c218_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3186.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2548 wrote to memory of 4600	2548	2026-07-10_81345a2255bd3a3a1e1af109fb62c218_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_81345a2255bd3a3a1e1af109fb62c218_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_81345a2255bd3a3a1e1af109fb62c218_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2548
- C:\Users\Admin\AppData\Local\Temp\3186.tmp
  "C:\Users\Admin\AppData\Local\Temp\3186.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-10_81345a2255bd3a3a1e1af109fb62c218_elex_mafia_stealc_tofsee.exe DAEC6B214638D968F764231EAB4453CE3F1E188D472FF732AD28F8C2F26DDA4430F869CD470EB79445FD278C876253BDFF478864B26CF349CD10E6C250D11863
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4600

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3186.tmp

Path C:\Users\Admin\AppData\Local\Temp\3186.tmp
Size 468KB
SHA256 de671fa58ea56b2be41e2c1d1c38e4f3f510c9192301e2cab99c487e478a93fb
MD5 bdaa33aa4ed58cf2d21d6563880acb8f
SHA1 95334a77d3b004e09f63f0473e4e0511dad74c36
SHA512 ef86fba578a844e8f1dcecc1184d32961006f43bc0384cb3951fd56a955c3b7cd812ed10eff8964cea0e0c72c2b81ce40cddca8ad796416c8d5e4689a98a7dbe
SSDEEP 12288:qO4rfItL8HGzTYZ+OApJgqzLBrbIA7bWmeEVGL:qO4rQtGGzTgvA/gqZrFumeEVGL
TLSH
T1CBA4F13A7581C133D29202745BD6EBAAAA3F75B40726A4C37BD8027D2F616D1E336347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download