254d031b0092af135012fa65d8ababf5873bb86022e12d292a94748082634d09

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_47821cb807d684bb4ecedb9440e13fe7_elex_mafia_stealc_tofsee.exe
Size 499KB
Sample260715-dfyrlsds6y
SHA256 254d031b0092af135012fa65d8ababf5873bb86022e12d292a94748082634d09
MD5 47821cb807d684bb4ecedb9440e13fe7
SHA1 7247666dc7c38bd46dc213e24c1bb928161b7929
SHA512 cb408610db0eadcdf36cad0efdd80d6980b0dbd072dfe0664f888c69a80f3d3ef7466c5c39445d3f786c3458d44e14b8d5624983655e0e8a639abdda441827e9
SSDEEP 12288:sO4rfItL8HPRNxC20jQc6+P7JNcxQPaK74wjY7dmsIhiqlj:sO4rQtGPXz8F1NNsAsIhiqlj
TLSH
T192B4E13A76858133C2D202711BDADBAAB73E7579132594C33BD4427D1FA6AE1C33A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4312	F920.tmp

Executes dropped EXE 1 IoCs

pid	Process
4312	F920.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F920.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_47821cb807d684bb4ecedb9440e13fe7_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5024 wrote to memory of 4312	5024	2026-07-15_47821cb807d684bb4ecedb9440e13fe7_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_47821cb807d684bb4ecedb9440e13fe7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_47821cb807d684bb4ecedb9440e13fe7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5024
- C:\Users\Admin\AppData\Local\Temp\F920.tmp
  "C:\Users\Admin\AppData\Local\Temp\F920.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_47821cb807d684bb4ecedb9440e13fe7_elex_mafia_stealc_tofsee.exe A4B1DF2E8D7A721927B259174AA758B14C9F5019497C49E0165D97356153C7C8CFDE8F623FE425DB4EADF352A4A8100ABDF1BAD13421AF5F7342820D66AA6E2D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F920.tmp

Path C:\Users\Admin\AppData\Local\Temp\F920.tmp
Size 499KB
SHA256 1e7c6d24c0a287c05625610849f7e896854ba8484bf9940711a5697eba0c13b5
MD5 de3fe2c5df1d3547c87d4dfc4eda1716
SHA1 1cc1bd029f0b4cd6ebd1674d6895103bfa48cffa
SHA512 22165919fc69139ff6bfa29eb9b660fb0b3a3dc38c37dbd04887c24b6fb4055f1325df3c456f72c677a967b530edc824845db3f29e3dd6a32e83b1114c49798e
SSDEEP 12288:sO4rfItL8HP5gmQFRYP822T/tRxGB5xmb5TB7dmsIhiqlj:sO4rQtGP5gmQ7YP0/tHGL0b5TBAsIhiI
TLSH
T156B4F126B7418133D2C202351BE6DBDAA73E7575132694C33BE4027D1F66AE1E73A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download