b1874a60f53ad1402a44111b484fd0676f98db720d7b006bde79c02254528e31

Analysis

max time kernel
150s
max time network
116s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_cb81ef5989a0b0022701799aa756dac8_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260714-prk6fafv8v
SHA256 b1874a60f53ad1402a44111b484fd0676f98db720d7b006bde79c02254528e31
MD5 cb81ef5989a0b0022701799aa756dac8
SHA1 56d48ea8ec339839bc6dc0ca047a6c069652fa70
SHA512 558f4d187d05dbc25b4f40993e74e8c2f83e1e9f732f502fd0b33e26e018f758c67ca3b5b3d8de19b64d02af3d2d50febf360f53c240333cd66f0d2e14444b29
SSDEEP 12288:bO4rfItL8HANOHT1pnwAViOlgvu3BpPbR4aAeo75UO:bO4rQtGANOHT3nwAEOlgEP4VVUO
TLSH
T14FA4E13A7681C033D29702751BD5E7AAAB3E7974472AA4C73BD4026D1F606E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2456	96B8.tmp

Executes dropped EXE 1 IoCs

pid	Process
2456	96B8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_cb81ef5989a0b0022701799aa756dac8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96B8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2456	1600	2026-07-14_cb81ef5989a0b0022701799aa756dac8_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_cb81ef5989a0b0022701799aa756dac8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_cb81ef5989a0b0022701799aa756dac8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Users\Admin\AppData\Local\Temp\96B8.tmp
  "C:\Users\Admin\AppData\Local\Temp\96B8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_cb81ef5989a0b0022701799aa756dac8_elex_mafia_stealc_tofsee.exe 4FBF7EFA3D7973D2FB39DA4D3F76EE42CF3FD57CC07B31F6E6024A439E51DB67943C353A838EAB9A5F5B29E322E7735262B06898ED47AF66589E4456418FAEF5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

96B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\96B8.tmp
Size 479KB
SHA256 6c5ae70b2dacf872dfe06b4658e846ae8054048a0025565f11b7c61fe2cfd75c
MD5 48b3f78116c501b235860e16ea242ed7
SHA1 53bd2e74c424b4dce82a88ea3350e84073e0ebf9
SHA512 2f95686bfdb1a37c3dd6283198bb230c4712a7298f19e0da76b0c46c165acba590678f1c679f63647a71fa8ae3f435896972a3c337f5c780d77d115c533d8596
SSDEEP 12288:bO4rfItL8HAhVSBKvnao/OM7/9T6ausNA075UO:bO4rQtGAhVgS7/OgaoVUO
TLSH
T1B9A4F13A77818033D29302315BE6D799AA3E39711726A4C33BD8427D1F656E2D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download