40444a65b54ac9ab26f278bc49dda0e7d6077dac1bd6a85a0a780c7438180d0e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 04:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_8741a1713bcb6a6493a61f00e443f844_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260715-e9588abx8l
SHA256 40444a65b54ac9ab26f278bc49dda0e7d6077dac1bd6a85a0a780c7438180d0e
MD5 8741a1713bcb6a6493a61f00e443f844
SHA1 3bf826f1e893396790c0c393e1969995f2680b52
SHA512 8ee52d177130de7d596662c37eee13869c3ebacd073f9f52d850626004ecd2af1ea1df3ba61c29618c7142327116800d498fc1589d5212cb6ff9877e17292534
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iSth7Etu7ru8IiupsZPl5iqxOtB3JuigLlt3Gs:Nb4bZudi79L1tggq/dxABZvgLlt3HCA
TLSH
T1BFA4F1243691C037E2A701354FFAC775557E79A14B2668CB3BD02BAD2EB02E2D634357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4624	D155.tmp

Executes dropped EXE 1 IoCs

pid	Process
4624	D155.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_8741a1713bcb6a6493a61f00e443f844_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D155.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2980 wrote to memory of 4624	2980	2026-07-15_8741a1713bcb6a6493a61f00e443f844_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_8741a1713bcb6a6493a61f00e443f844_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_8741a1713bcb6a6493a61f00e443f844_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2980
- C:\Users\Admin\AppData\Local\Temp\D155.tmp
  "C:\Users\Admin\AppData\Local\Temp\D155.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_8741a1713bcb6a6493a61f00e443f844_elex_mafia_stealc_tofsee.exe 766AB1A05630B3F1A9B7384BB82EF066DD846F6A5D54D3948DEBA5AAC989A290A37A4C2AB56A680DBE4982A56ACD0991E67B7CC3826D90BF564509192FCA3803
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D155.tmp

Path C:\Users\Admin\AppData\Local\Temp\D155.tmp
Size 444KB
SHA256 9e9b38596eb7dcbdb995ad9e367931d0586a95a6eaa9b84d79dc3a539da741fc
MD5 8f130f5d02cb5013662e68dc7fac7584
SHA1 86df58203e6dd0904c1edb9aa309542c63718e08
SHA512 562b227fee78169e17c3c7e89dc163cb24d0ed0318762dd87ddf5e55aad4dd5d240a59473dbd1df6f0f29bbe9bebb7582988a322dc1d485afd64041bfc82c81c
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStWWibWG+d+5/jlegIiHOge51If3uEnTLMD9c:Nb4bZudi79LcS+ajleg9OgxRTOA
TLSH
T109A4E1207192C036E2A715394BF6DB75693E39A15B2668CB37D42B7D6EB03D2E634303
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download