915fb0f2f7ae7255259467cffbe6cd8fcde00158c5cd430d43efb0bc398daa23

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 16:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_c3680a753a614635bee70799d9a99d60_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260715-t4ld7act4x
SHA256 915fb0f2f7ae7255259467cffbe6cd8fcde00158c5cd430d43efb0bc398daa23
MD5 c3680a753a614635bee70799d9a99d60
SHA1 b644bb2d8d0bcf0ea49046256126b4a786b90a5a
SHA512 9f33006b7f041fae34ce86cb6f85d6dad370b05e331795a6d3ebd0ab83d111b7005d45b31657ff2213d27daeb231ef4f7fd8ff8a4162ef7a724b677901b40a8c
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6zmEFOW5xDzfFXz6IDldKoJkoj+5wklWSMwhA6:Wq4w/ekieZgU61lPFD6CldKo/++cWQhN
TLSH
T18094F02135C6C036F1A716348AF5CA6AA9397C744B36A4C73BD02B6EAE712D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1200	4711.tmp

Executes dropped EXE 1 IoCs

pid	Process
1200	4711.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_c3680a753a614635bee70799d9a99d60_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4711.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2152 wrote to memory of 1200	2152	2026-07-15_c3680a753a614635bee70799d9a99d60_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_c3680a753a614635bee70799d9a99d60_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_c3680a753a614635bee70799d9a99d60_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2152
- C:\Users\Admin\AppData\Local\Temp\4711.tmp
  "C:\Users\Admin\AppData\Local\Temp\4711.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_c3680a753a614635bee70799d9a99d60_elex_mafia_stealc_tofsee.exe DD05D8D5251E358A10F5E0995C8076680CF1E071B2A4E55E32B227D3BBF7B81A9D4898A92C77D6CD0D985F67B3F104C0D13D4D10BE6DBF0A506FB50625E6A581
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4711.tmp

Path C:\Users\Admin\AppData\Local\Temp\4711.tmp
Size 414KB
SHA256 a682cd62fe0fb078211f36c292f58257cdcd296f8e08d39b42a3bfbd555f8d88
MD5 bdf06b6e62c73ff40224ce100ae90215
SHA1 c47483f76de1e41ebeb5b5801ff18733e26833a2
SHA512 2d2aa03350d804ced4934881fd242e19f66ad2cfb888b67c016ec246c2b64c46cf719209c11376579a5911d7a9d04cb27b07b86595885540f53c4c3e4de2ed27
SSDEEP 12288:Wq4w/ekieZgU6gLdGf6Tt3XhLAo0hgV8S:Wq4w/ekieH60VAd9S
TLSH
T1F594E0303586C036E1A715348BE5CB7A5A3A7DB54B32A4C737E02BAE5EA42D2D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download