f53dcf152e5fbaf3b3fe7565c1282763f5d1e575afe20ab28b1c494b8ad8e3d3

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_2ab0197dca32ffd8ae88784f9810cc29_elex_mafia_stealc_tofsee.exe
Size 660KB
Sample260715-dn32asdv4t
SHA256 f53dcf152e5fbaf3b3fe7565c1282763f5d1e575afe20ab28b1c494b8ad8e3d3
MD5 2ab0197dca32ffd8ae88784f9810cc29
SHA1 a53a06c59f4749380f24f1a66272b11b12decd9a
SHA512 b1834aa4738731a4c595c24be531aa467aaa1ae6a3a92454eeb99b6b16043d827a1780008e17612f28123d08302f223a813d9420a1d7b94fcf7904c95d0a78ff
SSDEEP 12288:NO4rfItL8HPIvZHVFfw3LSVjhn/QPxAJYR07tx7qg3kdI4S47ioeB/nNTnVW7vyq:NO4rQtGPIx1FfMSV1qmG05x7qg3kdI49
TLSH
T11CE4AF2FB3450373C2D203B22B4B99D7F72EA579137A85D224A8802D1767EB4937B395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4708	D9BC.tmp

Executes dropped EXE 1 IoCs

pid	Process
4708	D9BC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_2ab0197dca32ffd8ae88784f9810cc29_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D9BC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 828 wrote to memory of 4708	828	2026-07-15_2ab0197dca32ffd8ae88784f9810cc29_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-15_2ab0197dca32ffd8ae88784f9810cc29_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_2ab0197dca32ffd8ae88784f9810cc29_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:828
- C:\Users\Admin\AppData\Local\Temp\D9BC.tmp
  "C:\Users\Admin\AppData\Local\Temp\D9BC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_2ab0197dca32ffd8ae88784f9810cc29_elex_mafia_stealc_tofsee.exe 485EC5E971B7ACD2E0BFD4A3EBDF680857A932319F4D1F6DF93650AC3AC2BDF2EAAFB105EF22D3DA3AA830053342568652838B8AF1F9CBA0F4DCB4ED9C84F603
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D9BC.tmp

Path C:\Users\Admin\AppData\Local\Temp\D9BC.tmp
Size 660KB
SHA256 9d8caa23fdf7d07943e612cd841f8f6976c5789177a40471c8dc094f8c79965f
MD5 ad7c4dba68a2c91ba939465e24b88f00
SHA1 d88777854741fb56f4b87125fe8194a219f3614c
SHA512 4f4f164f0ffa1780cb500eaa4b563b80cac6e73e89023d03884e197cadb3718b41f8863a631ce6882d4200a576e4f6622b9f080055faf69fe8495f689a10e9b5
SSDEEP 12288:NO4rfItL8HP8NPC/Pi9OmLNmjkjNcEY7tx7qg3kdI4S47ioeB/nNTnVW7vyk7:NO4rQtGPvPi9OIY5x7qg3kdI4Z7ioeBa
TLSH
T1F9E4A02FB3450373C2C203B22B4B99D6B72EA575237AC5D264A8802D1767FB4937B395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download