291acaf2fa7f0a3d68b39f76cd9c95317782f63686023a14f6458c2fa3b4f20b

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260711-sethtsez2v
SHA256 291acaf2fa7f0a3d68b39f76cd9c95317782f63686023a14f6458c2fa3b4f20b
MD5 dd7afe198f75d1cd248de78d6f3d4884
SHA1 9990a38c2719c8f0f1bad820305ac47832cbadfd
SHA512 7b0ebad6ec28d215b933777ae61b1e24568f3907b3236592c043576432bfd1a435c34f8dc5630644c68d9c7516577a9da3a779b015c459517613553e83f0bee0
SSDEEP 12288:Nb4bZudi79LSfFPivdx1My1fV9cRBIg90zznBoEA:Nb4bcdkLWivOy1fVWHIgeXBo
TLSH
T11DA4F1243581C037E2AB11385BEAC736663E7DB05B22A8C737D46BAE5E702E1D631357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3144	235D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3144	235D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	235D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3848 wrote to memory of 3144	3848	2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3848
- C:\Users\Admin\AppData\Local\Temp\235D.tmp
  "C:\Users\Admin\AppData\Local\Temp\235D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-11_dd7afe198f75d1cd248de78d6f3d4884_elex_mafia_stealc_tofsee.exe BA505FECC8E496D49D629A36DBA924EF17D3B060CFC1B81D1EC39FA6DCA1E96ECD38EAE734024136B47FEEA57996B802B1F003538CC40388A9D0298B6399B8BC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3144

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

235D.tmp

Path C:\Users\Admin\AppData\Local\Temp\235D.tmp
Size 444KB
SHA256 8856875aa81dd96c1fe18aa9b07323b90ef14f2309dfe0ac48db63ecd4e14525
MD5 d428916cf235ace4dd3c27fb61ae755b
SHA1 5848ccbadbcf671d176a6cef0e20da3e22eaf581
SHA512 cdde6bdc5fedbe9b8e96425fc283de140b83a369f6bb254025b2e6468a0424dd9a608b19ed2ac9d6fa3b9600036bb026cfef80b676726e0d47917f89d1c1aa14
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iSt0wXMTsqMvCmbBnd2FssXLYUhoyHjvqmvWKh:Nb4bZudi79LDwMrR1keoyemfm6u/pA
TLSH
T12FA4E0243081C037E25626354FF5DBB66A3D78B14B2668C737D46BAE2EB02E2D635317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download