24193ffb7d24a7886cf00347eaf3f24e16f6855ad172a1afb984cc44259ab3fa

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 16:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_da54d34bd385fca7b2b7b70587037e37_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260717-ty883abs9s
SHA256 24193ffb7d24a7886cf00347eaf3f24e16f6855ad172a1afb984cc44259ab3fa
MD5 da54d34bd385fca7b2b7b70587037e37
SHA1 45563a6ee17c815d5014aee6e40c0d28664571f8
SHA512 463f39c2723e4dba34d84fd8cac060e6da3545ed2bd8904fe0341b4451c63156937ca02cee9cefbed9f869ff7f09e54bc2879b418da510924e821c39397aec94
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iSttMdP8ZaYkHs0xYX3kMxkGRIh4HCCJBEOgJZ:Nb4bZudi79L1YpX3kqwCHCSPMiA0a
TLSH
T1E7A4E0213681C037E2A712344AE6C7F5663A7DA15F2164C73B947B6E2EB02E1DA3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3672	39B4.tmp

Executes dropped EXE 1 IoCs

pid	Process
3672	39B4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_da54d34bd385fca7b2b7b70587037e37_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39B4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4356 wrote to memory of 3672	4356	2026-07-17_da54d34bd385fca7b2b7b70587037e37_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-17_da54d34bd385fca7b2b7b70587037e37_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_da54d34bd385fca7b2b7b70587037e37_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4356
- C:\Users\Admin\AppData\Local\Temp\39B4.tmp
  "C:\Users\Admin\AppData\Local\Temp\39B4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_da54d34bd385fca7b2b7b70587037e37_elex_mafia_stealc_tofsee.exe 54401CB1F49BB0AC05E90C6C1DC8042095AC26FD869B7B6DC812C7857C7872D8AFF6273BDC0C44616537F63A1CC577CFBC575F0588316ECFAB5069C30F970363
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3672

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39B4.tmp

Path C:\Users\Admin\AppData\Local\Temp\39B4.tmp
Size 473KB
SHA256 f21d1ab577656ec66dd1302d1ea8984d44485eb044969ba961f833a870ee9751
MD5 fb8ecaf3150c43c3f412ef448c4e21f3
SHA1 70f72c7b7cb2d689b89494570644b9dc153d0639
SHA512 ae1d4bc67f774dbc44d082906d665bda5dc3f09090720840cc1d35d9b77271f934f5ec0d9199c1670f8002faf5a6112aca3e5d0fadeefdc18641c8e7d416a004
SSDEEP 12288:Nb4bZudi79Lh3jTz3zCEpHz4WOZcsIlYzmCc3A0a:Nb4bcdkLh3/n7pHU7LzTX
TLSH
T11DA4F0243592C037E2A716340AE5C7F5627A3DA15F7164C73B907BAE6EB02E1DA3431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download