b7f487f63e966428a5d3a08cde270b41956a7121e193dac0d6221de67685ef08

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 18:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_8002cd1f3305787171aae1209d793690_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260717-xjs53sft3x
SHA256 b7f487f63e966428a5d3a08cde270b41956a7121e193dac0d6221de67685ef08
MD5 8002cd1f3305787171aae1209d793690
SHA1 32d012527e76610d20414c2056c3333d837b39f3
SHA512 399117f3b4ef4e2abb4f2be264bf8922ed353dec2056ffa40ba22102265444343481e61fbf5115e1371f40ecf6159d593b942fbcf4b6d3a0f8540009bb076cfa
SSDEEP 12288:qO4rfItL8HGFALPBioaOInKJotMJDUqjI2++xlT1o7bWmeEVGL:qO4rQtGGkpiop/otMZZUf+xlT1oumeEk
TLSH
T126A4E02A7641C133D29312741BEADBA6A63F79B00722A8D33BD4467D1E613D2D37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5116	F26A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5116	F26A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_8002cd1f3305787171aae1209d793690_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F26A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4604 wrote to memory of 5116	4604	2026-07-17_8002cd1f3305787171aae1209d793690_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_8002cd1f3305787171aae1209d793690_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_8002cd1f3305787171aae1209d793690_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4604
- C:\Users\Admin\AppData\Local\Temp\F26A.tmp
  "C:\Users\Admin\AppData\Local\Temp\F26A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_8002cd1f3305787171aae1209d793690_elex_mafia_stealc_tofsee.exe 75B7FA3930E747755D265500E585C5CB37FBE1656B336A8E9FD064BA2DEF871038160FCFEF6AA09746D84636ED0C71F7170354CB98D8C95F8DF35421C6956EF6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F26A.tmp

Path C:\Users\Admin\AppData\Local\Temp\F26A.tmp
Size 468KB
SHA256 6f34691270d462a13edd3546449f39d0e61d7bbfbd60d0f6e13ea4a417671709
MD5 d7b06338c59668cea03ec07ca548b256
SHA1 8da056ed2b7244cf6970903428029e9093815e2f
SHA512 948219b8e6ff23dbd2328e256ad0ea927d4727edadf24d20594cb79ee43cf99f08d7662bf8a8c415b8e5655aaf501f5edf1d22b4ae6402c0ed66fe365c406266
SSDEEP 12288:qO4rfItL8HGHDrVS9e4ByaM7LN7bWmeEVGL:qO4rQtGGjrVS9e4ByaMNumeEVGL
TLSH
T18DA4F136B682C133D29302754FE6DBA6A62EB5B40726A4C73BD4427E1F606D0C736397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download