3aeed89c671c52514db7ef43465ef475a0860f9ccdd1280679aab4f6d659e0c6

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 10:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_0961717c333672d077746e801a87f826_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260714-l4dekscz9w
SHA256 3aeed89c671c52514db7ef43465ef475a0860f9ccdd1280679aab4f6d659e0c6
MD5 0961717c333672d077746e801a87f826
SHA1 72c5d5dfb971e92e6efc319217b85729b2938032
SHA512 5eeb08a60547cace996e033dc3aa166cf1649d0f4ad2ce885fa5c3496fec92a3d4a2639055fd8ad5c89bb6905af04fe2408b16e9528db233ffee5cba447c6a78
SSDEEP 12288:3O4rfItL8HPJ0t9uILdtcYgXKqLN+5UO7rKxUYXhW:3O4rQtGPJfIhtcYgaezO3KxUYXhW
TLSH
T17FB4F12677818233D29202711BE6DBEA6B3D75B51726E4C337D4427D0F61AE1E33938A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2920	6102.tmp

Executes dropped EXE 1 IoCs

pid	Process
2920	6102.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_0961717c333672d077746e801a87f826_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6102.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2952 wrote to memory of 2920	2952	2026-07-14_0961717c333672d077746e801a87f826_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_0961717c333672d077746e801a87f826_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_0961717c333672d077746e801a87f826_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2952
- C:\Users\Admin\AppData\Local\Temp\6102.tmp
  "C:\Users\Admin\AppData\Local\Temp\6102.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_0961717c333672d077746e801a87f826_elex_mafia_stealc_tofsee.exe 3415C3FE1774D40CA7C2503B483963FE7A00EEFA852C0CE5820536C2788F6AB80CA621ADCF9CFC9CE551EC478887F912021883D7149A1B1574F956A7393CBB17
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6102.tmp

Path C:\Users\Admin\AppData\Local\Temp\6102.tmp
Size 486KB
SHA256 1f08dbcce72caaf767daa70e73922e848efc2a0dd7eced29a40cacc36d9610dd
MD5 9bb3891e43da6b49ff487ec1abc91754
SHA1 82427123c6faa160e9bb3ea5c725669a4e4ffb0d
SHA512 2d3d2fd5d4bb3993b01bbe21158a7e46134900cbe0cabe453915819fe8ae52023e7030e51819f5d3348eae830062491b8b6ad2d365ecb2930cc3cb86958f106c
SSDEEP 12288:3O4rfItL8HPBN7EuwuY4AezzCCkLxr4LdIjbpgKaQC7rKxUYXhW:3O4rQtGPIuwuY0aCk9kWjFLaQC3KxUYk
TLSH
T17BB4F12AB681C233D2D302351BDAD7D6B73E78B01725A4C32794067D2E65AE2D37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download