5700e460002e88d18f127572ecca09bc97edf6b139077c22a1b872150ba7f54f

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 01:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-13_22ffa2d95686e9e821a9a77efc78527b_elex_mafia_stealc_tofsee.exe
Size 499KB
Sample260714-b39fhsct5l
SHA256 5700e460002e88d18f127572ecca09bc97edf6b139077c22a1b872150ba7f54f
MD5 22ffa2d95686e9e821a9a77efc78527b
SHA1 d3829ea188da1ecba48fa6d16d74c5da09c694aa
SHA512 96e98f375d97237c53d648fc6012f86fbb23143b4ed328dd933a894fae2aa861a4c831606dab9d985c9de18b9c663f2f16e36d9564b8ec278f4c5cba8f81283d
SSDEEP 12288:sO4rfItL8HP5HJzn0ZR0gV4YiF8rSzM5EZ7dmsIhiqlj:sO4rQtGP5Hx0ZWF8rz5aAsIhiqlj
TLSH
T117B4E02672428233D2D302751BD6DBAAB73E7571133694C33BE4416D1F66AE1E33A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6096	57BB.tmp

Executes dropped EXE 1 IoCs

pid	Process
6096	57BB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-13_22ffa2d95686e9e821a9a77efc78527b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	57BB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4232 wrote to memory of 6096	4232	2026-07-13_22ffa2d95686e9e821a9a77efc78527b_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-13_22ffa2d95686e9e821a9a77efc78527b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-13_22ffa2d95686e9e821a9a77efc78527b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4232
- C:\Users\Admin\AppData\Local\Temp\57BB.tmp
  "C:\Users\Admin\AppData\Local\Temp\57BB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-13_22ffa2d95686e9e821a9a77efc78527b_elex_mafia_stealc_tofsee.exe B76B723FD62A0D2EDDAEBF47EA6B07AA3FFF5142E2D134A5A4C71E8BC8F1CF53AF1BFE3448D12807D268E451486AEEB2CE22A0EAADE31390F24EF5A5D872A5EA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

57BB.tmp

Path C:\Users\Admin\AppData\Local\Temp\57BB.tmp
Size 499KB
SHA256 cabad0f1d21c67049fa4ae4b585525ccea5a1769dde56e2bc80e921d6d85d819
MD5 9d2a0a5a780e687b1f842e77f74fbf01
SHA1 9afa33366943156d58ba487a2661abfd6dfc5b5d
SHA512 c604f4913d53ce983a93db12236bfaa503c1b5173db11841058339aea34604809683ce31f8dd207c1c24a0b9c9d83b1a7ee0e66805ac3d681b84c6f18c3b94fb
SSDEEP 12288:sO4rfItL8HP6/yP6MV/6cQOVLwl9Isq7dmsIhiqlj:sO4rQtGPWS6MVSnI8qAsIhiqlj
TLSH
T1BCB4E12A76428233D2C302711FD6DB9AB73E7575072694C33B94427D1FA5AE1D33A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download