8b91e7b6f291cdef19646d5de1ebce51e42e54238bda93df59d2835c344fcda0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_1521c2f6c76521b20b893b075af960b3_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260717-yb68eact7n
SHA256 8b91e7b6f291cdef19646d5de1ebce51e42e54238bda93df59d2835c344fcda0
MD5 1521c2f6c76521b20b893b075af960b3
SHA1 a5c133c9011607ef8db1e925f37dfe3ee5845479
SHA512 a77bd582bd23d481e0329011ab501de09eb66f110549904bd88ebcdfd03fbd839a6f7eb679037697e95f1446f021f8947fe29ebdf5695dd2e9074125b00f5c61
SSDEEP 12288:qO4rfItL8HG1sq3LekH+zlyDvhdvI+qvD7bWmeEVGL:qO4rQtGG1X3L+zIvhMDumeEVGL
TLSH
T17DA4F1267681C133D29312B50BEADBA6B63E7575072694C33BE8027E1F616E1D37630B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1464	455C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1464	455C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_1521c2f6c76521b20b893b075af960b3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	455C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2332 wrote to memory of 1464	2332	2026-07-17_1521c2f6c76521b20b893b075af960b3_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_1521c2f6c76521b20b893b075af960b3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_1521c2f6c76521b20b893b075af960b3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2332
- C:\Users\Admin\AppData\Local\Temp\455C.tmp
  "C:\Users\Admin\AppData\Local\Temp\455C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_1521c2f6c76521b20b893b075af960b3_elex_mafia_stealc_tofsee.exe 519ADCADD427555D372F6B8504E16C6398E3658F423DA4B1DF3E006600B566EA6DA4991C700E5E3BEA1BD54BB4DE44A87EF1D2D16FCE399E2612AE74418697ED
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

455C.tmp

Path C:\Users\Admin\AppData\Local\Temp\455C.tmp
Size 468KB
SHA256 75635e6e3faa92738120a5f190a17e6267a1bf1bfc063562ff0ac1aa228f6026
MD5 335fc35928e9aa003fe25e2c5cb318a7
SHA1 dca3735242ca980f7db6e5d8913a36cc2c9f12ba
SHA512 6e4570263e1760e2670b969e687391cf79dd66fbb6a83d56449ff99df778771c3ea500b49fc7be723e63cb7a160577b2bf1961231c284f21d6c1e77e3c0c283c
SSDEEP 12288:qO4rfItL8HGw4pvLGXaMVk0HPHyOg/9r2zJPVvC3LoaXKY7bWmeEVGL:qO4rQtGGZxiXa8k0HrqG9838a6YumeEk
TLSH
T160A4F1367640C133D29212710BDADBAAA63EB9B50735A4C337D8036D5EA56E1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download