1720b11812cdba7257d86b3bb507f6be72a4b8232fe3292bf927f124f36a78cf

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260717-fned2sbs8m
SHA256 1720b11812cdba7257d86b3bb507f6be72a4b8232fe3292bf927f124f36a78cf
MD5 e37d43d7cd83ca979d0b3829c30498ac
SHA1 4e4d891365eba1292a260ef26678bf17c2354d46
SHA512 c44471d6926a797cc5ac594cba56ea4956bbf7861fce8ecb4c0ad0aa826ef4c96b8edd77899a7a470596a7cfcc7a0582d5778a8f79d8701cc8aff5353f804072
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStLtWFsQGeJtq+OS/K8Ahou2knSvGGIpcs18J:Nb4bZudi79LEYlGkXS8AhoNvGxcsNA0a
TLSH
T150A4E1243192C037E2A716384AE9C7B6663A3DA05F2668C73BD4376D6EB03E1D635317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4920	2EB7.tmp

Executes dropped EXE 1 IoCs

pid	Process
4920	2EB7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2EB7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 4920	1652	2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\2EB7.tmp
  "C:\Users\Admin\AppData\Local\Temp\2EB7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_e37d43d7cd83ca979d0b3829c30498ac_elex_mafia_stealc_tofsee.exe 2BF64816A792A955DD25105A7038FEAC0C9E46F8600FBB2F0483D2650C27B4C298EB78461C7545F788923496C3A01FD3BF7D3F00A912CD8A3A4CBABC284BE346
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4920

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2EB7.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EB7.tmp
Size 473KB
SHA256 05e2879c73ffcbcba43065692b5ad92a3a8bb0e494f150d41dfe775c7b18b132
MD5 aaa0f51fbe74cbb09bcbbb5c4747cbda
SHA1 f39b3afb4b3490418c4d35038627effb853cf21d
SHA512 cd56e25a7aa0f50d50a021dcc7874919a91250a61581fa0665fc506c3559aa78779cef33aacada774dfaabe3351033ae0f56c74ae89627dc6092775e7dfb19a8
SSDEEP 12288:Nb4bZudi79Luh+aWMufsW5/JNsmPb6m0J6co86Y+0WhA0a:Nb4bcdkLuhlxW5/wmPb6mkX+0Wo
TLSH
T115A4E0253181C037E2A702354AE6C7B5663A7DA15F3158CB3BD83B6E6EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download