a07cb1a793f7b1e5906d3ad58b07db0b2284aa42a44ca7fc557f090e6e11d1cd

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_9c07ad6c5da3446a25711df879f45396_elex_mafia_stealc_tofsee.exe
Size 441KB
Sample260715-ctvrfacw9z
SHA256 a07cb1a793f7b1e5906d3ad58b07db0b2284aa42a44ca7fc557f090e6e11d1cd
MD5 9c07ad6c5da3446a25711df879f45396
SHA1 73acb1bc7b4cbcadc77391899acbade6dbde54c4
SHA512 715bd8699bb5c0a6983b2d64730410ffcc24dc59656c5881e9d94c92c2f73216d42ea1134c395082277b2c1a380826b1b0ffc39620b28e8a564f08edccf27119
SSDEEP 12288:6i4ET7+0pAiv+lthxQF86SEuG4pLvxRL3SUXc:6i4ETK0pD+jzg86BOlvxRDSt
TLSH
T1CDA4E1217245C032D25716300FF4CB7966BEB5644766A8CB3BF4CA6F6DA99D1EA3030E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6012	F98E.tmp

Executes dropped EXE 1 IoCs

pid	Process
6012	F98E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_9c07ad6c5da3446a25711df879f45396_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F98E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4960 wrote to memory of 6012	4960	2026-07-15_9c07ad6c5da3446a25711df879f45396_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-15_9c07ad6c5da3446a25711df879f45396_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_9c07ad6c5da3446a25711df879f45396_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4960
- C:\Users\Admin\AppData\Local\Temp\F98E.tmp
  "C:\Users\Admin\AppData\Local\Temp\F98E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_9c07ad6c5da3446a25711df879f45396_elex_mafia_stealc_tofsee.exe 3B2D8F8AA23639B2F3E9D150623D9543D450EBFB8146D7C203D7DA840A31EFDE2D21C8F5B5EB49F11BC7E1905257A333DB6322246A5A9502F942F08314DA29C3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F98E.tmp

Path C:\Users\Admin\AppData\Local\Temp\F98E.tmp
Size 441KB
SHA256 99ff96482558b94c2f30cee040a5b3edcf2f1d2dee946c38f737b7c9c071e528
MD5 c95e48ca51628901acc13b0469f1e6c8
SHA1 ba9bf226a545d39c6d409a4f63a93de05526f19e
SHA512 042a644fb2b81540579e3a651eaf84ce99ad5864f40a53ed7769d0d8a1b07224a979ae6a35e0cb6d472eec94268551f14c34cecc9e0843df2af33a541acf0c44
SSDEEP 12288:6i4ET7+0pAiv+h3uSmwRDj4DHQEk7atPveOHc:6i4ETK0pD+h3unDwEkiX8
TLSH
T146A4D0207141C032D35B19344BE5CB79666F75604791A8CF3BB4DBAFAE68AC29A3430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4960-0-0x00000000005D0000-0x0000000000647000-memory.dmp

Download

memory/4960-7-0x00000000005D0000-0x0000000000647000-memory.dmp

Download

memory/6012-5-0x0000000000970000-0x00000000009E7000-memory.dmp

Download

memory/6012-8-0x0000000000970000-0x00000000009E7000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads