1b7cfd1928624f0b1801f32b25cba8e72af4f3bb825888c75af067d0c33d1e99

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_4a99bd23359cc2a44126637b3c7d1e45_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260715-dfad1sat7l
SHA256 1b7cfd1928624f0b1801f32b25cba8e72af4f3bb825888c75af067d0c33d1e99
MD5 4a99bd23359cc2a44126637b3c7d1e45
SHA1 a237b19afab702f97a0e6c6ac7c4921cc37e65a2
SHA512 e1f9be7b85a138640b707b8f768b46af58b378fbf9c34e44336cefaee71d7036a5b9d55ca6cefe9d905422f3a6150a0eab9a6dc26829e88391fa6912e7f84e60
SSDEEP 12288:Ci4g+yU+0pAiv+htRKn98ldzGORHhkE2n:Ci4gXn0pD+cnCVBhrW
TLSH
T11E94F1213592C037E2E71A344BF5C76A267E79A2472268CB3BD41BAE2E603D1D734357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4640	9D50.tmp

Executes dropped EXE 1 IoCs

pid	Process
4640	9D50.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_4a99bd23359cc2a44126637b3c7d1e45_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9D50.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1112 wrote to memory of 4640	1112	2026-07-15_4a99bd23359cc2a44126637b3c7d1e45_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-15_4a99bd23359cc2a44126637b3c7d1e45_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_4a99bd23359cc2a44126637b3c7d1e45_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1112
- C:\Users\Admin\AppData\Local\Temp\9D50.tmp
  "C:\Users\Admin\AppData\Local\Temp\9D50.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_4a99bd23359cc2a44126637b3c7d1e45_elex_mafia_stealc_tofsee.exe D728D4F1E729F87D6798525F6FC0DE6AF4D4189062A0C03D4D7B25E6B32E27B8CA6560C27AF29415093F85C770BA6F1F2EF255D8E73596A6C3384CDC991C76CC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9D50.tmp

Path C:\Users\Admin\AppData\Local\Temp\9D50.tmp
Size 433KB
SHA256 312f8e128dd711942fec06c251255ee18c57060c9b3a8f51b0884418b0acbdf6
MD5 14c7639cbff0c1ccc1cfc9785459e554
SHA1 5be76d8cec1380cf91168a71fca44a372d341cf8
SHA512 1d534e44d5d8011503815748511f48b08f888ba996fedc8dee8f44bfa66d6f6954ce08baae0c7dbcbc2149a2ac3fa1f6f8c9927f667da6f4328c2a129aeaf5f1
SSDEEP 12288:Ci4g+yU+0pAiv+gkWn+pOX1NpkhYDIYyLTD52n:Ci4gXn0pD+Vy+psSYDeLX5W
TLSH
T1DB94F1313582C033E1A706344BEACB9A55BE79B50B2668DB3BD41BBE6F602D1D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download