754ad9a0b4bdecc9b922c79dae434fa1dc70526b164befd6bb5f8813b57ff562

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_ab2091a9b3bc33be47e70eb9f59ae9c9_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260715-e25ygsbw6p
SHA256 754ad9a0b4bdecc9b922c79dae434fa1dc70526b164befd6bb5f8813b57ff562
MD5 ab2091a9b3bc33be47e70eb9f59ae9c9
SHA1 8a8d44e621c4b649b6219ae3ffe9bd720aa47252
SHA512 54ca3792620c30f48caf1b47feec877e3b52a252a1a80e2a1a6688ce225a514af5a204cccb9d79eadff79b844c85bf28c55c71500d8272465277eb32666cebee
SSDEEP 12288:Z594+AcL4tBekiuKzEr3sWgAkOjP+ixdq1sQCmTD0l:BL4tBekiuVr3sejPrPlQC20
TLSH
T1AC94F0253582C033D2A706384BE2C7AA557E79B60B2668CB3FD01BB95FA06D2D774347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1708	A723.tmp

Executes dropped EXE 1 IoCs

pid	Process
1708	A723.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_ab2091a9b3bc33be47e70eb9f59ae9c9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A723.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3948 wrote to memory of 1708	3948	2026-07-15_ab2091a9b3bc33be47e70eb9f59ae9c9_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-07-15_ab2091a9b3bc33be47e70eb9f59ae9c9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_ab2091a9b3bc33be47e70eb9f59ae9c9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948
- C:\Users\Admin\AppData\Local\Temp\A723.tmp
  "C:\Users\Admin\AppData\Local\Temp\A723.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_ab2091a9b3bc33be47e70eb9f59ae9c9_elex_mafia_stealc_tofsee.exe B4D55328CEDD8607195687E552D9E32C584785EDD160F3396D7581746F6CED9A0D8718B7581C9B8F0015B7CDA52E558F88292849723F927BB5D2A299A2CB4453
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A723.tmp

Path C:\Users\Admin\AppData\Local\Temp\A723.tmp
Size 428KB
SHA256 581116f34d75c1bdfa316c963294a88a22ec07139c64c6e9ff19a123f2c8fdb3
MD5 8f66492af00e3aecb79d233104855c65
SHA1 bc692e2012bb734cf7a70f8b3f364451202d110c
SHA512 f8df9dc54a0011400adb7ccfdbbef09002d54258508fca39f1208a0171d83b0fa5537c488448cf0c8c631213d1c37754dc5b89a4de055313f47a10c9ab1e88ea
SSDEEP 12288:Z594+AcL4tBekiuKzEr4m/LIenMkaxairAbnDXxcREA/l:BL4tBekiuVr4mZMkXirAb58
TLSH
T1BF94E0313581C033E1A712384BF5CB69157E79B24B2AA4C73BE02BAD5FA46D1D63435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download