a9ce91e37a9ba74aa34efdae7577535d8a9696a6340cb4e3a68a9e36696c0fe5

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 22:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_8496d0ab3e7cf39c55149943991ee911_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260717-137dlaft6k
SHA256 a9ce91e37a9ba74aa34efdae7577535d8a9696a6340cb4e3a68a9e36696c0fe5
MD5 8496d0ab3e7cf39c55149943991ee911
SHA1 0135047d6c6ab92b2264dda6344cd60557b1383d
SHA512 b464331e06e8d8a0c67a45b695f1785a4a7ed1317eb5903fe9f1b7ef2d0c3f699fed44a47c81e22d55233985cebac5cacb3576f3e30ff0628887e9c43cfcc78f
SSDEEP 12288:Nb4bZudi79Le9D0ESJvZ11hmZyCZjNl7A0a:Nb4bcdkLRZWyC/I
TLSH
T114A4E0243282C037E29702354AEAD7B5697A7CA15F71A8C73B943B7D6EB02E1D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2416	F6BF.tmp

Executes dropped EXE 1 IoCs

pid	Process
2416	F6BF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_8496d0ab3e7cf39c55149943991ee911_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F6BF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4504 wrote to memory of 2416	4504	2026-07-17_8496d0ab3e7cf39c55149943991ee911_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_8496d0ab3e7cf39c55149943991ee911_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_8496d0ab3e7cf39c55149943991ee911_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4504
- C:\Users\Admin\AppData\Local\Temp\F6BF.tmp
  "C:\Users\Admin\AppData\Local\Temp\F6BF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_8496d0ab3e7cf39c55149943991ee911_elex_mafia_stealc_tofsee.exe 718A90AF002830FF43D7F1AB76C8B3502A5F60E49047E8E6935B1AE335BDFFF61F9481FADBC6A5EB032714390D685444FE737C34E234B38186A02B3AC0E6AE7E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F6BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6BF.tmp
Size 473KB
SHA256 8ebf306db5ab95660aacdf9c88573ad1db79a97692b7ccd648097c39ebcbb76a
MD5 53dda5e1f2980bb612027b1753cf42ec
SHA1 2d7eec888979145d199385b5fb9bf597665fef4c
SHA512 70506a4b7edf90e7bcced4a41dc6e8b699b44851a9933e24eda98378f28167b439345e820babd390f54dcc810d2f7d12619be3f65903dcb5ef7e2d45015154f0
SSDEEP 12288:Nb4bZudi79L+Ra8pYMWlmmw3GwVpUvMeA0a:Nb4bcdkLdl1w3tpWM9
TLSH
T12BA4F0203582C037E25716354AE1C7B6567A7CB18F65A8CB3BD43BAD1EB02E1DA3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download