fa4eace8afc3bc3910e4bee7ba14f82acfe55ec579644c3d0d608acaa8760dcf

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 20:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_1cc42db164bada4ce0810945f7def85a_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260710-znv7cab18x
SHA256 fa4eace8afc3bc3910e4bee7ba14f82acfe55ec579644c3d0d608acaa8760dcf
MD5 1cc42db164bada4ce0810945f7def85a
SHA1 57bf4360f83b782afedb1df1db91e0795126db44
SHA512 21f2d92711aa14ffb107d963fef83863532acfedd8d1b6d117003f875ff9b8d667caa964d5c7a19499118c095f4e28a591089a54d7f512951aaf362bae56797d
SSDEEP 12288:Nb4bZudi79Lqb4FbEHwUTbSfctwPmgctPLl9X9E2LA0a:Nb4bcdkLiMbEQUTbhVgc9x9X9E2O
TLSH
T14EA4E0243682C037E2A712344EA6CBB5653E3DB15F6168D73B9437AD6EB02E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4980	2B4C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4980	2B4C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2B4C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_1cc42db164bada4ce0810945f7def85a_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3388 wrote to memory of 4980	3388	2026-07-10_1cc42db164bada4ce0810945f7def85a_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_1cc42db164bada4ce0810945f7def85a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_1cc42db164bada4ce0810945f7def85a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3388
- C:\Users\Admin\AppData\Local\Temp\2B4C.tmp
  "C:\Users\Admin\AppData\Local\Temp\2B4C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-10_1cc42db164bada4ce0810945f7def85a_elex_mafia_stealc_tofsee.exe 4E01DCDD183594321E21705F243BA913637F64035FCB515B337A4D423762F9FC47FA717AB5A8F627FF285F8E78A67F681DDEF986F02182B0CDEC0CA75CC43FFB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4980

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2B4C.tmp

Path C:\Users\Admin\AppData\Local\Temp\2B4C.tmp
Size 473KB
SHA256 b049bd130b8431268cac66d49e0abeb9f8cd316b24bf49f165418b684600b840
MD5 195bb51eea5d0beceb15fcf4662675d2
SHA1 525393f8bae73e283dbbc2de4698e8597f484349
SHA512 cbd47798919b02bd89b397e5c57b44f4e5f815f5fde26ba33a61a1e000a4776c00f6127d7520f4b2612ce3ca51f9e6b94ba11c7d920b48396f76301af85625cd
SSDEEP 12288:Nb4bZudi79LeJx26F0LOIeHHK6zFi55cqWJh6Ug1A0a:Nb4bcdkLe75F0SIeKYi3cqWJsA
TLSH
T126A4E0243581C037E29716358BE5CBB5653A3CA16F62A4C73BD03B6D6EB02E2DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download