679a21744f8653776d9919e2edd911c754fa8cd231e8fca54020c70f8a3b31ff

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 14:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe
Size 660KB
Sample260714-rr72baew2m
SHA256 679a21744f8653776d9919e2edd911c754fa8cd231e8fca54020c70f8a3b31ff
MD5 dc8872b9c7b5836cc867150f977fe11a
SHA1 7ddf232ad224154d89100dd709af0a5156cf3baa
SHA512 614fc3a37cc0414138779ba415071683142b9629e2117caa71cdcd06135bd8ffcb8f2f73727cf928319fcba71929328acbd65ed58f6230cf0f377d26fa2302f5
SSDEEP 12288:NO4rfItL8HPx+MW73NZEHnpXbXmOF57tx7qg3kdI4S47ioeB/nNTnVW7vyk7:NO4rQtGPxRWbEHprZL5x7qg3kdI4Z7ic
TLSH
T19EE4AF2FB3450373C2C203B22B5B99D7F72EA579137A85D224A8802D1767EB4937B395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5828	B31A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5828	B31A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B31A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 5828	5676	2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Users\Admin\AppData\Local\Temp\B31A.tmp
  "C:\Users\Admin\AppData\Local\Temp\B31A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_dc8872b9c7b5836cc867150f977fe11a_elex_mafia_stealc_tofsee.exe F18DA23083CD37AB786AF7EE410DDC7A4198B48DAB8E9A086C03A24C1EBDC2F36DABA57D7DB398CCC539CCE11DA28ACBD41BD2B36425E9BF2F1DF2FBE8D4286D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5828

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B31A.tmp

Path C:\Users\Admin\AppData\Local\Temp\B31A.tmp
Size 660KB
SHA256 40e8228a478e1003c51827022e7048e1187e7e31ca315c5145001b6b789592a2
MD5 7b7587ac1ffb532e141aaaa783a01f55
SHA1 4c39031644c511211b81cdef34279dfe948c9cae
SHA512 2a47d1f9b6eaa82b08292651b1424c174dac96d288f658ce84d85adf2af2d53e411121c33bfb383d557d1364ed5bf5811fd56638db785b10ab51ca1064df51df
SSDEEP 12288:NO4rfItL8HPqYx6h0/miTLRMYwGeJ2E7tx7qg3kdI4S47ioeB/nNTnVW7vyk7:NO4rQtGPlx9/LTGf2E5x7qg3kdI4Z7ic
TLSH
T16CE4A02FB3450373C2C202B22B4B99D7B72EA575237A85D22568802D1767FB8D37B395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download