4a26fcf579efc053d22ed4640132f2afb907bd349e337a6059387c8afa368ee2

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-14_794a2cd9bc24338385ad48619b1c3818_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260715-a2zdgsa16w
SHA256 4a26fcf579efc053d22ed4640132f2afb907bd349e337a6059387c8afa368ee2
MD5 794a2cd9bc24338385ad48619b1c3818
SHA1 948b90540fe5136031b5bbb5818686e0c6d93c99
SHA512 8e73f089f459ae11f296bf4e30b6fff8dfa85fd3d8912b525ad2b05974bd22e0a6889851051e1f21a4a99461aad3703a6a4d103711415bba6503555bc2ecdacf
SSDEEP 12288:Ci4g+yU+0pAiv+QCg4UGaHNu+RVSgPbJZIh0Agn:Ci4gXn0pD+QCgHNH823K0AA
TLSH
T11094E1307546C033E59715344BF9DB6A6A7E79B50B22A8CB3B840B6E2E603C2E775347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5436	AB3A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5436	AB3A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-14_794a2cd9bc24338385ad48619b1c3818_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AB3A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1964 wrote to memory of 5436	1964	2026-07-14_794a2cd9bc24338385ad48619b1c3818_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-14_794a2cd9bc24338385ad48619b1c3818_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-14_794a2cd9bc24338385ad48619b1c3818_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1964
- C:\Users\Admin\AppData\Local\Temp\AB3A.tmp
  "C:\Users\Admin\AppData\Local\Temp\AB3A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-14_794a2cd9bc24338385ad48619b1c3818_elex_mafia_stealc_tofsee.exe E867ACA0E62BB2A6A765FFB297C4FF7B3747059DC8408F6A71FAF1F9468BBB16465D02A18A20D9C452F4C426BAB82C24D6BFCD33C3707CE120509318090C8284
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AB3A.tmp

Path C:\Users\Admin\AppData\Local\Temp\AB3A.tmp
Size 433KB
SHA256 111ce037677296824c93a874a309ba4e7e7bb04e48146b56132e0960bb8b8d42
MD5 76924b20a6caa7630a5ebba804875da8
SHA1 3872524e6eba36f48c0abad135f1fc4243244316
SHA512 bf14218c3b7302016f7dec2373aede806f67e15479a149d3d0f5f32cc917892ad35a75ce8cc657db0f4f83f84e206d4852aca5860f87274813f021510a16ad4c
SSDEEP 12288:Ci4g+yU+0pAiv+6HSW+HH5CvGWOtxBvtr2ZTdABSKn:Ci4gXn0pD+USAGWOPBvBUna
TLSH
T14794F1303592C037E2A715350BF59B66267D78B14B16A8CB2BE41BBE6F603D2E234357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download