07f0951ef1c51ab7648ad5035b8f6bb6da4b7d5bdc59080aed7b529635c5f8e8

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 17:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_bd17cf34d0e55cf51efe1c05d4b73ddf_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260710-vxsqcsfy9s
SHA256 07f0951ef1c51ab7648ad5035b8f6bb6da4b7d5bdc59080aed7b529635c5f8e8
MD5 bd17cf34d0e55cf51efe1c05d4b73ddf
SHA1 da7927b6e46cb8099add4657f977be17b711c3a4
SHA512 581b0e03cc04306a0796250a81164b895ba82b281e52e01d7bd3649c1fe05f007f3e6996c1ca337a4c00675bd28eadc400da93f29f83a0528159f5bd125c13ee
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYWl9qk54nRF6pcgqTie60+WfVblMa:Wq4w/ekieZgU6Nl9JOnTYHqme0WfNlMa
TLSH
T1B4A4E0207186C036E2A7163446E5CBBA653A7DA15F71A4C73BC03BAE6E706D1DB3530B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5660	B220.tmp

Executes dropped EXE 1 IoCs

pid	Process
5660	B220.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_bd17cf34d0e55cf51efe1c05d4b73ddf_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B220.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5948 wrote to memory of 5660	5948	2026-07-10_bd17cf34d0e55cf51efe1c05d4b73ddf_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-10_bd17cf34d0e55cf51efe1c05d4b73ddf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_bd17cf34d0e55cf51efe1c05d4b73ddf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5948
- C:\Users\Admin\AppData\Local\Temp\B220.tmp
  "C:\Users\Admin\AppData\Local\Temp\B220.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-10_bd17cf34d0e55cf51efe1c05d4b73ddf_elex_mafia_stealc_tofsee.exe FEE7C05ABD85EE58AECF1D2F25B159DBEF993F5C32093C6E2B140BFF1FC621D8098485DB30C8582A787B8BD79DE6007AB1E813E34DD09F4378282719E07EBF88
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B220.tmp

Path C:\Users\Admin\AppData\Local\Temp\B220.tmp
Size 443KB
SHA256 bb432bf9563d71e46bca615c946f2289eb1d3393030a024c02743a04f32fc4b7
MD5 7d7691d2514e7db3bd5c6f0b417b76ae
SHA1 c52380abd47e2514235d3f17898d34cbfc1a7230
SHA512 76a6994e57f8379242a363618fd4e477df2f7c67a9645161153c7b6bfbc6a923f61df045e78dbea92b674891ca5911a964c2ec4f94b9d6a423a944e77b70a624
SSDEEP 12288:Wq4w/ekieZgU6c81+SoYjwuAz470in+i7lMa:Wq4w/ekieH6c81+SoEwuSriPP
TLSH
T105A4D0213586C037E1A705348AA5DAE9693A7DB44F31A4C73BD43BAE6E746D0DB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download