37a7fbc7b0f5c10ab2199a07dbd7cd688ce78e78c3c7b0a547af7b174916bc31

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 16:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_83ca6968e1886a71d5312b0c8a64d941_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260715-vee2jsg17j
SHA256 37a7fbc7b0f5c10ab2199a07dbd7cd688ce78e78c3c7b0a547af7b174916bc31
MD5 83ca6968e1886a71d5312b0c8a64d941
SHA1 a6256b83ef8c254ea52f0a70ea6a70b224d29e8c
SHA512 a3ab916b164da1d33df268f04525b0083b0c78742080bb2c6f1776ec61661ba67800ab851a887bc44d7253b007296a6327881719120f6ea6309386dc3037fc01
SSDEEP 12288:Nb4bZudi79L4qFlj25XtK+7J/h2yZ9gHpfeBxrxSeQIMPA1mA0a:Nb4bcdkL4qFZ262LZ9gJmbxShNPE
TLSH
T1D7A4E0207682C037E1A715354BE1C7B6A97A7DA05F32A8C73B9477AD6EB02E0D634317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2516	3CE0.tmp

Executes dropped EXE 1 IoCs

pid	Process
2516	3CE0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_83ca6968e1886a71d5312b0c8a64d941_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3CE0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5068 wrote to memory of 2516	5068	2026-07-15_83ca6968e1886a71d5312b0c8a64d941_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-15_83ca6968e1886a71d5312b0c8a64d941_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_83ca6968e1886a71d5312b0c8a64d941_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5068
- C:\Users\Admin\AppData\Local\Temp\3CE0.tmp
  "C:\Users\Admin\AppData\Local\Temp\3CE0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_83ca6968e1886a71d5312b0c8a64d941_elex_mafia_stealc_tofsee.exe 726364318F4C9486ACBF259AF1A9FEE1828E09A8FD41E6A7990D8400E1CAA5CA93200E1EEFB23B703C8194DE7CE65568C09023692711E6F08DC5B7474343383A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3CE0.tmp

Path C:\Users\Admin\AppData\Local\Temp\3CE0.tmp
Size 473KB
SHA256 43f7f68dcc2e4b62640825f709ab1df9bf7a7a8e450e5ca42e5d6acd034ce660
MD5 1e13ed766cfdf74c6aec49e4dba359c6
SHA1 6ddbe4a59915e8e8477979d3b0a44e2ee2453c72
SHA512 ab212e4d85d199569176ae50d88dea52008940c2de89ab14654c23319f7c0fcbd803247daf104b39ffc94766279e0d448cbb578edd50af463e15c569d5c93f71
SSDEEP 12288:Nb4bZudi79L4i2Q4lqqz3Rt7YblFRlA0a:Nb4bcdkLsQ4IE3Rt7qlXU
TLSH
T175A4E0243281C037D29705384BF5CBB5663A7DA14F25A8C73B943B6E6EB02E2DA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download