7dc2ba94bc478a0fe0722ffd144e76f8035f30bab90188ee19c17b77c0692a5d

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/07/2026, 16:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_dc4aaf8612580f91adf5d8302be374e4_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260714-tpxtnsgs6l
SHA256 7dc2ba94bc478a0fe0722ffd144e76f8035f30bab90188ee19c17b77c0692a5d
MD5 dc4aaf8612580f91adf5d8302be374e4
SHA1 1e945428d062224d7721124eb3383dc5350b524a
SHA512 0059a89566a77e39090a968efb8960046fd5247b18cd7da67dbe505ad1c960c1f3665243612310b94d8bfcdbfca8327c6d0c093a2519e366d09338bf7486a303
SSDEEP 12288:Nb4bZudi79LITf0Z1ihsXyTohjEDzHVY2BQ4XgMjZ5A0a:Nb4bcdkLITf0DizVDjbw
TLSH
T131A4E0243292C037E1A705390AE2C7A5663E7DA15F3564CB3BD43BAD6EB02D1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3420	E46F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3420	E46F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_dc4aaf8612580f91adf5d8302be374e4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E46F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5780 wrote to memory of 3420	5780	2026-07-14_dc4aaf8612580f91adf5d8302be374e4_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_dc4aaf8612580f91adf5d8302be374e4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_dc4aaf8612580f91adf5d8302be374e4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5780
- C:\Users\Admin\AppData\Local\Temp\E46F.tmp
  "C:\Users\Admin\AppData\Local\Temp\E46F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_dc4aaf8612580f91adf5d8302be374e4_elex_mafia_stealc_tofsee.exe CF1494347B7CAA5E64134F51BA5AC9BA1987DA1C742EC30DB9D5327A3952A703EA98BB32BF5890F30C80336CF772ABBC812B75B5577A3B88A8252E4EE90903E2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E46F.tmp

Path C:\Users\Admin\AppData\Local\Temp\E46F.tmp
Size 473KB
SHA256 88b12bc7f4e211f36ec3801e0d205ab29ebfac608700e9ba495e1952ac805f3c
MD5 c7e2bc9dd8ec577a2d8c67355b44049c
SHA1 f5a438305fcd14b534dbb652fc46303607da6dc3
SHA512 5ba13eddf385a1c94938df7f13e5d2915da2eb58a46fafa1ca20809d256140025b03fd3c0a8d8126c143aee7668b60a197f7c4a077b28f3a3602cf481f5337b3
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iSt0FAlw/fvCsW2K9ab20EOODeIz9JbB30h/Q7:Nb4bZudi79LDow/fqMZ9+bz9tB3m9A0a
TLSH
T130A4D0253681C037E26702354AE6C7B2567E3DA19F22A4C73BD03B6D6EB06E1DA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download