7a125b6f991348326b9e576fbaf4ba8380b842d2092a6e71a48a24446d831d78

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 12:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_4373c9f64667cdb01ff15834ea35882e_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260715-pc8m7aft2v
SHA256 7a125b6f991348326b9e576fbaf4ba8380b842d2092a6e71a48a24446d831d78
MD5 4373c9f64667cdb01ff15834ea35882e
SHA1 cb887cc55a653bc272463f1e178df71623ee1b8d
SHA512 c8d5e12a90d5389293b2340bdef9ea2fbcd17e8c36085305b04dd9adf326267efae59f3ea1cdd859f0ca3abb4bb1b5275d99a8958bf98bce3a0119acf0640818
SSDEEP 12288:Nb4bZudi79L2wk51u4N/8p6lM5SfR/l0DRK/A0a:Nb4bcdkL2wkMBAf0lJ
TLSH
T199A4E0243582C037E19706344AE6C7B6967E3DA14F2265C73BD07BAE6EB02E2D634357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1512	91B7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1512	91B7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91B7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_4373c9f64667cdb01ff15834ea35882e_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 1512	4216	2026-07-15_4373c9f64667cdb01ff15834ea35882e_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_4373c9f64667cdb01ff15834ea35882e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_4373c9f64667cdb01ff15834ea35882e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\91B7.tmp
  "C:\Users\Admin\AppData\Local\Temp\91B7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_4373c9f64667cdb01ff15834ea35882e_elex_mafia_stealc_tofsee.exe 19C79EAE3C8432AF3ED982969096390A815D4ACAC79E052DED60FE4EAC3BCD1F4D74F417355B8BC38E875483D1323480C639FD71C6C852F2493035FD6815A886
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1512

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

91B7.tmp

Path C:\Users\Admin\AppData\Local\Temp\91B7.tmp
Size 473KB
SHA256 2961b9e9ae8ed46b99e18f7b3123892d6bd2154bd8d8843b12784f3f682059b5
MD5 f0324ea3dda1d658fbfce5c6eb466718
SHA1 0d1d1fe23fb6dd461c38475e0a835d4a6129df61
SHA512 7acd3a81cb258eb246d736d55db93d4bc29774a182516b4934a88e726a6e4ba4dcf1dced8ee74770c25f2d6f713e9bb34fc5b65eb3f4bf685a0e5865461a2473
SSDEEP 12288:Nb4bZudi79LNmysnbPyGQs/bvu0gLgwn1PA0a:Nb4bcdkLsnbPoIFQM
TLSH
T14DA4DF203182C037E2A716344AE6C7B5967E3DA15F2164C73BD03BAD6EB06E2DA34757
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download