a3936428f5cf36ac4e61da0f87813a9bace1de1f658e4bdd11b4a3a92e566132

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 22:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_77e425658ee71e6b2a16f910945ec7e9_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260710-2fe69sfv7w
SHA256 a3936428f5cf36ac4e61da0f87813a9bace1de1f658e4bdd11b4a3a92e566132
MD5 77e425658ee71e6b2a16f910945ec7e9
SHA1 53192360f0b8b0397cd31e7120694dce66b8464e
SHA512 19b09795cd4b2b4717f1c9a0507a6227c092c96820fd9aeecd27935fe65e02705b6fa8b1b83ebfadfc9cb97550c7f5022dac6cb054ffec0ccc52ae232f509a8b
SSDEEP 12288:Ci4g+yU+0pAiv+47c++nHdOXU/hWNNONdn:Ci4gXn0pD+4e9MCWNNONF
TLSH
T12C94F1207542C077E2A715394FE9CB66297E75720B1664CB3BD00BBE6EA02E1D778387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1180	4155.tmp

Executes dropped EXE 1 IoCs

pid	Process
1180	4155.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_77e425658ee71e6b2a16f910945ec7e9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4155.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 1180	2592	2026-07-10_77e425658ee71e6b2a16f910945ec7e9_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_77e425658ee71e6b2a16f910945ec7e9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_77e425658ee71e6b2a16f910945ec7e9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\4155.tmp
  "C:\Users\Admin\AppData\Local\Temp\4155.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-10_77e425658ee71e6b2a16f910945ec7e9_elex_mafia_stealc_tofsee.exe E8E5F60C448E4CF3650F62FBCA0AE5BE4B4E2F5F26273345833F58925A9EB2A75D492C73BA5A1409E9FAB50103D7348A68453C51294D11A50E053D5AF9752EA9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4155.tmp

Path C:\Users\Admin\AppData\Local\Temp\4155.tmp
Size 433KB
SHA256 cdeab5c563c90132afb539c6eacf9e532031effde803afc8b023300cd52727ad
MD5 33797dc75bcf1469dd6803cce84bda52
SHA1 e205f45ed0e67c2e5b446e903efe5f599b0eafb5
SHA512 d646f4e9a643ed3f0c6f521e07bd096d0af582b6116083b1230f290236f328c079f96e5e86a7dfd89e2155de55d240246319b9861567d846b3a4cb2e178ae288
SSDEEP 12288:Ci4g+yU+0pAiv+c+aHDReGGjRSl91wh27kSb9n:Ci4gXn0pD+c+kEs91OEkM
TLSH
T18894F1213101C037E69715344BF5CBA6697E79B18B26A8CF7BD00BAE6EA42D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download