0e6e722d75a9c98a776cb0404116af4d9c71253db460a6ea3d0e561774f70130

Analysis

max time kernel
148s
max time network
112s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 16:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_80120b4db9c5f00770343cd732e6cd9f_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260711-tfydvaew2m
SHA256 0e6e722d75a9c98a776cb0404116af4d9c71253db460a6ea3d0e561774f70130
MD5 80120b4db9c5f00770343cd732e6cd9f
SHA1 dc4be58cf979523a73ea6e0c09d33bc4fc40e95d
SHA512 1db185b816f7cd7bab9fae25bf1abae9844e0c808f44bcbe532c91e4fc732c3ab61ac6fb9d16093d5965579c074ba66eab2490ff1c8f7252fe1fdfbb26fb0661
SSDEEP 12288:bO4rfItL8HA46IDNOVgReUhozTZ+jh0chJ75UO:bO4rQtGA46x6hWZ+jhVUO
TLSH
T1D6A4F126B781C133E29702751BE6DB9A663E3574032AA4C73B98027D1F71AE1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3860	258.tmp

Executes dropped EXE 1 IoCs

pid	Process
3860	258.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	258.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_80120b4db9c5f00770343cd732e6cd9f_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 3860	5816	2026-07-11_80120b4db9c5f00770343cd732e6cd9f_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_80120b4db9c5f00770343cd732e6cd9f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_80120b4db9c5f00770343cd732e6cd9f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Users\Admin\AppData\Local\Temp\258.tmp
  "C:\Users\Admin\AppData\Local\Temp\258.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-11_80120b4db9c5f00770343cd732e6cd9f_elex_mafia_stealc_tofsee.exe 6F3C743BDE73210CEE4BBB2162DB311F382F7939B0B1815F3CB680ADC710840992F367BA5DA65AEE46BB919753E5BC1071137A58886939BBA90F82AC902B261D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

258.tmp

Path C:\Users\Admin\AppData\Local\Temp\258.tmp
Size 479KB
SHA256 acd2912fd9fabe4cf8d8f894c42a599c9637c4e66e75fc115e1f62791d8fee7a
MD5 408121dd8c6545f3b02ecc49b57ad655
SHA1 f824adf3fbb948464e239230784707929d7e69ed
SHA512 090f0edfe1ae022b0eb015f5ec9228437ac5c9befd9ad9cdab9229911f97ffcdf1f37c8e363ff0fea69224ebdd09a948ced82cd0d172a614688ab27dcb27729a
SSDEEP 12288:bO4rfItL8HAbNzRDvPlEvWta8tPvWTfmc75UO:bO4rQtGAh9rietvxWTfmcVUO
TLSH
T132A4E1267681C133D29302750BE6E7A6A73E78B10726A4C33798067D1F647E1D77A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download