851addf63809f8935068df930651cb9c856dfb9b10837f635c649314657b8fb7

Analysis

max time kernel
148s
max time network
100s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_daad95c37370190a3e1af7bd32fcd4c3_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260714-tp31pags7j
SHA256 851addf63809f8935068df930651cb9c856dfb9b10837f635c649314657b8fb7
MD5 daad95c37370190a3e1af7bd32fcd4c3
SHA1 10cff4328d9937d55ec5b9799123804ff4b6a7c6
SHA512 07a5026f3fe86ea5d3db83104d6d3d3eee9f1b880d8848cb6de44f81a95fffdae57b8fe7998b67d6f484a29f84ba875ed5d39bfe00aefe1f0df5df734351fb67
SSDEEP 12288:bO4rfItL8HAmPSN3PD29/rvmNp6DfstmJkF75UO:bO4rQtGAm6N3r29/yNBtXVUO
TLSH
T1A0A4E02ABA41C133D24312751BD6EBD6A63E78711366A8C77BD8027D1F216E1D33638B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4560	46DE.tmp

Executes dropped EXE 1 IoCs

pid	Process
4560	46DE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	46DE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_daad95c37370190a3e1af7bd32fcd4c3_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4916 wrote to memory of 4560	4916	2026-07-14_daad95c37370190a3e1af7bd32fcd4c3_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-14_daad95c37370190a3e1af7bd32fcd4c3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_daad95c37370190a3e1af7bd32fcd4c3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4916
- C:\Users\Admin\AppData\Local\Temp\46DE.tmp
  "C:\Users\Admin\AppData\Local\Temp\46DE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_daad95c37370190a3e1af7bd32fcd4c3_elex_mafia_stealc_tofsee.exe 45B216A249F367037FAC960467B7A6073C9073BFA8140DA1ACC565473547B1F34852AC66F2C27D5A6076E6FB1B20B4365B8529C7607FE72CB6DF7ACFDFEC9B82
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4560

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

46DE.tmp

Path C:\Users\Admin\AppData\Local\Temp\46DE.tmp
Size 479KB
SHA256 281df868db47396bf71013c210a68e01ba5496f74b47fc37af5ddf6c0d8f095a
MD5 486712fcc637bf759763b8b38e39c94e
SHA1 e01fb4e209ee436cefa7b03fabf992e22c1ce9f3
SHA512 51a4b89064776e32cd9c9039c726e2c294e1cd463797f67bf8b1c967e6be6a3a3f41b1499019e1b7189f554359020a9655e6235490d83a7528dd6be6acf2039f
SSDEEP 12288:bO4rfItL8HAexM7R3qRLcSIMK9OJonBS6DUO75UO:bO4rQtGAexM7R3aoMK9OJoBSmzVUO
TLSH
T10EA4E126B781C133D29302715BE2D7AAA73E7974072AA4C73B94027D1FA16D1D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download