70247d714fb82868b85991c60375c4727a64f4aa6a310e402dfdd8afdc43defd

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 07:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_96508d7db56099811c1b2b68df3cf3de_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260715-jn2fcsas41
SHA256 70247d714fb82868b85991c60375c4727a64f4aa6a310e402dfdd8afdc43defd
MD5 96508d7db56099811c1b2b68df3cf3de
SHA1 42e7622c1cf9543ee26e344716ba5287f4c217a0
SHA512 e704b710f53e68c907988a6cb9b730210861a8015d884b732828106f7a37a5d0a8e5a132b79fac865e91f16b3be3a35886e8349bb8a959d2e21593ec6307fdb4
SSDEEP 12288:Nb4bZudi79LY4h11HAcvQNTfsje8P0cdqayH3A0a:Nb4bcdkLd11RQNTEje88cdv+C
TLSH
T1AEA4E0243581C033E1A706350AE6DBB6567E3DA15F3168C73B907BAD2EB02E1DA3535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5888	FE02.tmp

Executes dropped EXE 1 IoCs

pid	Process
5888	FE02.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_96508d7db56099811c1b2b68df3cf3de_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FE02.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4844 wrote to memory of 5888	4844	2026-07-15_96508d7db56099811c1b2b68df3cf3de_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-15_96508d7db56099811c1b2b68df3cf3de_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_96508d7db56099811c1b2b68df3cf3de_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4844
- C:\Users\Admin\AppData\Local\Temp\FE02.tmp
  "C:\Users\Admin\AppData\Local\Temp\FE02.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_96508d7db56099811c1b2b68df3cf3de_elex_mafia_stealc_tofsee.exe 578A5C64B2F942A83B7CB9D4AA736E3437F0972FD21AA0B364A3D99CEC7F3071AB0D5CEA403BCD82320F129256F63895EE2501B8A7D017215482BF5828967324
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FE02.tmp

Path C:\Users\Admin\AppData\Local\Temp\FE02.tmp
Size 473KB
SHA256 496069bd33a542ebdc522e445583b89542a861f7ac511d971a15964219e50fcc
MD5 cd8f5559d68fe1e54019e99c4269acff
SHA1 82121df53ee3f3aaed23b500264b9d037a13bb93
SHA512 34d63ced103fe31b20e1dc46d2083ee21828a42f51c9d202cfcf3bb58ad141259529d7a170fc2a10a9091da102062c0a364e637ec7162e0ae10a37c58782550e
SSDEEP 12288:Nb4bZudi79L5WvSyFiZWctHEgWwxmAA0a:Nb4bcdkLMoyjwA
TLSH
T171A4F1243581C037D29702354AE6C7B2AA7E7DA15F7268CB3B9437AE6E702E1D634307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download