0645057be793bbac5f053d9667d0d3086d2173ba7b7b4b2b7689a3168c29955d

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 04:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_2a8cc3053c81856cfe29d2a1cb2e2ba6_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260711-feaz9sd16x
SHA256 0645057be793bbac5f053d9667d0d3086d2173ba7b7b4b2b7689a3168c29955d
MD5 2a8cc3053c81856cfe29d2a1cb2e2ba6
SHA1 f5ee5581e5b95b733edf60111a8525625cbf7eb9
SHA512 7cdb7e097264425f0a7e4f4674f3779f281b00cee76c3d6a48239eb1bce9c0febfaf2a16a9ea69b9f01c4a2cfffd5079340a1376ae20080cf0771a456141df35
SSDEEP 12288:Z594+AcL4tBekiuKzErdJWfKVUmkgZ9L94dl:BL4tBekiuVrdJ9FkaW
TLSH
T1A594F0317582C033E29712384BE5C76A55BE79A60B26A8CB7BD00BBE5E647D2D334347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4184	46C3.tmp

Executes dropped EXE 1 IoCs

pid	Process
4184	46C3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_2a8cc3053c81856cfe29d2a1cb2e2ba6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46C3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3076 wrote to memory of 4184	3076	2026-07-11_2a8cc3053c81856cfe29d2a1cb2e2ba6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-11_2a8cc3053c81856cfe29d2a1cb2e2ba6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_2a8cc3053c81856cfe29d2a1cb2e2ba6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3076
- C:\Users\Admin\AppData\Local\Temp\46C3.tmp
  "C:\Users\Admin\AppData\Local\Temp\46C3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-11_2a8cc3053c81856cfe29d2a1cb2e2ba6_elex_mafia_stealc_tofsee.exe 49DDBFB8F052E3EA35E53A7884E39435F13A9AD58529AC441F1AB2224E1FC9F83881EB86B5147BE29339260273C0D03BC2F2AA8BC5AFCA6564DA3147DC4A63E0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

46C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\46C3.tmp
Size 428KB
SHA256 b925eed7918e77e77866f20840b506bff32d0cd60debc7536f95332adc553935
MD5 5c5a371f9f70db8022abcfe31f9f8350
SHA1 19fe9bf196717d1566432b9d659d98c2790d1776
SHA512 9238727ef8969f7989b2887854095b0370dc203d6f40cc73a5a080f2be41a630aa094285109e79c99f9cf1b056c34cfd373888035536de2f269a5cad83fea189
SSDEEP 12288:Z594+AcL4tBekiuKzEr7x/PplwNW/CV6SZOPjhvJ1Zl:BL4tBekiuVr7hfwNWOj4xd
TLSH
T16294F0253481C033E2A712384FF5CB66557E39A24B26A4CB7BD41BBE6EA42E1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download