810766b715f0b36a4440776100815e31038363a1c05b7f329798384070155dd6

Analysis

max time kernel
150s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_ac40d84e7bf2b002bbf465f9d42c2c49_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260717-w7fdfsey71
SHA256 810766b715f0b36a4440776100815e31038363a1c05b7f329798384070155dd6
MD5 ac40d84e7bf2b002bbf465f9d42c2c49
SHA1 0b13e2c4368daf8f157c673d46917c248d31c0cc
SHA512 b51182f52caa5430a70194e9a5ca89927da66a1e8fef01fd29c0c1b701268b4615d01a655e39ab4f0632d65e50f29788f5d7ee73d315286899b77fe0a69b9a0d
SSDEEP 12288:qO4rfItL8HGK4Tv8QUEVxv0ZzHj7bWmeEVGL:qO4rQtGGPD8Q/GZzHjumeEVGL
TLSH
T179A4E13A7281C133D29302755BE6DBAA663E79B44766A4C32BD4027E1F653E2D33530B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2508	3994.tmp

Executes dropped EXE 1 IoCs

pid	Process
2508	3994.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_ac40d84e7bf2b002bbf465f9d42c2c49_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3994.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3476 wrote to memory of 2508	3476	2026-07-17_ac40d84e7bf2b002bbf465f9d42c2c49_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_ac40d84e7bf2b002bbf465f9d42c2c49_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_ac40d84e7bf2b002bbf465f9d42c2c49_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3476
- C:\Users\Admin\AppData\Local\Temp\3994.tmp
  "C:\Users\Admin\AppData\Local\Temp\3994.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_ac40d84e7bf2b002bbf465f9d42c2c49_elex_mafia_stealc_tofsee.exe 1904BEB4639896584D10635547B5622E09ABA526B877ACB5DF54C643DB407F7D1E6FD93C7E25B6C91FA427EF4B247AA0F025C0CD6A2D4A000216FE02F83999D6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3994.tmp

Path C:\Users\Admin\AppData\Local\Temp\3994.tmp
Size 468KB
SHA256 4d2d6df1e4897fd91343301dba008b08d72ce5d83045c7b220a4472ba16024e2
MD5 bbe848f81ceb3479bb0ee347e105368c
SHA1 93b45c2b1717d09ee204eb50d27feb80f6b7f631
SHA512 9a8510750a6ac16e5b61b5b18504aa5be1deed837c77bc3206d091507ea28e118588c69f39de1045907b66f1887a62b5790d2e3064b27e6b0451330122dd66dc
SSDEEP 12288:qO4rfItL8HGI2HjYRgzXVvcmicYCcUcA8AV7bWmeEVGL:qO4rQtGGayXVvtit7dA5umeEVGL
TLSH
T109A4E13A7281C133D29302755BE6EBA6A63F79B00321A4C73BE4067D5E616E1D37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download