64ef1a4259563c8d62e8b6e0b01d3d3c8f3b96302471549c76df0898526f7096

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
13/07/2026, 22:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_300ccb6ea09d651f38e0994377ccfe22_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260713-2wdndact81
SHA256 64ef1a4259563c8d62e8b6e0b01d3d3c8f3b96302471549c76df0898526f7096
MD5 300ccb6ea09d651f38e0994377ccfe22
SHA1 a8a39d765a6d5c9dc442d3ad56a66282eab0b4d0
SHA512 03804c4839689451d9b0376be51cd88f3742fc692e7ff253643b65f9d48f893e29b29685e0b60959caf1ce019232583c79016cddd7fe5d2264ef951fa21f19d4
SSDEEP 12288:Nb4bZudi79LrHwxvGW8JI4aqNVkw7oNTgd9xA:Nb4bcdkLsFG54qNV97oN
TLSH
T12CA4F1203592C037D29712394BE6CB756A7E39A14B6268C73BD06BBD1EB02E2D734357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1916	4750.tmp

Executes dropped EXE 1 IoCs

pid	Process
1916	4750.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_300ccb6ea09d651f38e0994377ccfe22_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4750.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 1916	1444	2026-07-13_300ccb6ea09d651f38e0994377ccfe22_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-13_300ccb6ea09d651f38e0994377ccfe22_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_300ccb6ea09d651f38e0994377ccfe22_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\4750.tmp
  "C:\Users\Admin\AppData\Local\Temp\4750.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-13_300ccb6ea09d651f38e0994377ccfe22_elex_mafia_stealc_tofsee.exe 95069156C122AC8C0E742AFB48ED33380B5A54BB1C7BCB60751715DBF943742AA462E3C0438642F2664CF426A840D0409DA1889BFDB542028873C17E9705E911
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1916

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4750.tmp

Path C:\Users\Admin\AppData\Local\Temp\4750.tmp
Size 444KB
SHA256 83b5d9edf75f8b995170e2d8d50dfc163341f6322256810388dd7744c6d4931d
MD5 bc8bb0cfaa479ace7255e3dc0d255dcb
SHA1 8bc2abfb01933e9f8510af790acf21ff8a3f2495
SHA512 a2798f0a48b7db972f36703578848e55204c9507882d4c9e9a8c99e06d4085357183551f843794f28e7f21eba63b8a9c5f25e44b515ed34f966cc1853e8334c2
SSDEEP 12288:Nb4bZudi79L44x5EMjxmkqmtGVegr5WqQMcA:Nb4bcdkL3iMj1tGVvQ
TLSH
T13DA4F1203682C037E29715354FE6DB356A3EB9A14B25A8C73BD05B6D6EB02D2E730357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download