95e2fe097e15f16a2493b83bbbd5a9135d1169ddcf407c6a1596bc5b92049b64

Analysis

max time kernel
148s
max time network
111s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 14:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_32403c85529ffe1948a2db5ed176e422_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260714-sblc2sfs3n
SHA256 95e2fe097e15f16a2493b83bbbd5a9135d1169ddcf407c6a1596bc5b92049b64
MD5 32403c85529ffe1948a2db5ed176e422
SHA1 871307330b7f4f59735216d2e39bd910d7001cf9
SHA512 100b05eb513259eed7189cdfc3279e7a0b64051d2a3d7e476043f86e3fb2f29f64a428dbd872d388144ee317bd64002f8f0af4b9664e0987da8f7e4fe72e5fc6
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYyH7dIPu7GgPsc/sTwVpajSUz/0KJQ9uHRRwuWK:Wq4w/ekieZgU6R74gcLjz/z+A33Xl
TLSH
T11A94E0307586C037E1A716398BE4CB69592D7DA04B36A8C73BD42BAE6E741C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1288	B368.tmp

Executes dropped EXE 1 IoCs

pid	Process
1288	B368.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_32403c85529ffe1948a2db5ed176e422_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B368.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2536 wrote to memory of 1288	2536	2026-07-14_32403c85529ffe1948a2db5ed176e422_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-14_32403c85529ffe1948a2db5ed176e422_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_32403c85529ffe1948a2db5ed176e422_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2536
- C:\Users\Admin\AppData\Local\Temp\B368.tmp
  "C:\Users\Admin\AppData\Local\Temp\B368.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_32403c85529ffe1948a2db5ed176e422_elex_mafia_stealc_tofsee.exe 75275DCD515DFD714F273A423884F05C9AB945E3799D3B42110BC626711E90C901224A9730981ACA531638AFBDA4D8BAEAC67A0F3EDD0120310FD2CC4D5F7682
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B368.tmp

Path C:\Users\Admin\AppData\Local\Temp\B368.tmp
Size 414KB
SHA256 a2df3f4508279ac0f8b36100663b5bbd9fedc0933223725078130318256e2aa9
MD5 940b47190e8ab873f24e8bd7abddf5ac
SHA1 c6ce0e8ccad04855e855e3ce8ba5df9fbcbfbbfb
SHA512 8c98ff44988b3a1a3cda6ab41b7929762e952b3d399ed985182a43734b96f3814701b7d64fd3df1f271c3cf9da7c3c43202d07502fd87fc0c510f6a4028347b5
SSDEEP 12288:Wq4w/ekieZgU6VcXn2pMCXdTafw0EE4Ol:Wq4w/ekieH6V+gaLH4O
TLSH
T14794E1203586C037E2A715354BE5DB6A693ABD710B36A4CB3BC42BAE5E712C1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download