e26d9f73539bc05f3be2b179a075426c003e4ffe12da7e4faeb4c1544944f120

Analysis

max time kernel
150s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_e600f8b99acc4247832a182f49f648ef_elex_mafia_stealc_tofsee.exe
Size 660KB
Sample260718-a3fb1aay2l
SHA256 e26d9f73539bc05f3be2b179a075426c003e4ffe12da7e4faeb4c1544944f120
MD5 e600f8b99acc4247832a182f49f648ef
SHA1 7d089d0c759fb42ef35093c1a720ce3d053b04f7
SHA512 b0af23863289907e233446ac44ea9d4df6d72cc709e36fca009dced48d4430f3425dc157181662742dd47b95a1aac456058c63ee2c9330a28cbe4b50a46697e9
SSDEEP 12288:NO4rfItL8HP773Slebg4mcmKS15FuUhB9wkbE0I7tx7qg3kdI4S47ioeB/nNTnV+:NO4rQtGP3mcancUhDwkbTI5x7qg3kdI6
TLSH
T151E4AF2FB3450373C2C203B12B4B99D7B72EA579637A85D224A8802D1767FB4937B395
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4140	196A.tmp

Executes dropped EXE 1 IoCs

pid	Process
4140	196A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_e600f8b99acc4247832a182f49f648ef_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	196A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 4140	4688	2026-07-18_e600f8b99acc4247832a182f49f648ef_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_e600f8b99acc4247832a182f49f648ef_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_e600f8b99acc4247832a182f49f648ef_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Users\Admin\AppData\Local\Temp\196A.tmp
  "C:\Users\Admin\AppData\Local\Temp\196A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_e600f8b99acc4247832a182f49f648ef_elex_mafia_stealc_tofsee.exe 16282C81475B115A6D3CBBB7CBE0D39A17A5AB66186929DE0FCFE9A6E2B8F675E7D7D0F992B180A43A5268E1CCDA72913A2664336AA81E610A2F3BE7767FAC5A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4140

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

196A.tmp

Path C:\Users\Admin\AppData\Local\Temp\196A.tmp
Size 660KB
SHA256 2adf5ab1fd7987adf0a148ff759e3da974b68029c9ba17b957ad7cefb7c2ee3b
MD5 8b548f7658cf669d007c025a83467000
SHA1 cd3125b146e45da5539479c3545e90d8d437b7d4
SHA512 f80123311212ff0bcb8e9bce50576781513a434db147ef11398b0f41d632285f9a7faf8d1b49874cc6ca5d213abf8f48275b5d64441ad5bf3776c1cc1b46840d
SSDEEP 12288:NO4rfItL8HPiZ0OvU7VSPUepGbdvyZZ5ZcMg7tx7qg3kdI4S47ioeB/nNTnVW7vj:NO4rQtGPiy4dY0v55g5x7qg3kdI4Z7ic
TLSH
T140E4AF2FB3450373C2C203B22B5B99D6B72EA579137A85D224AC802D1767EB4D37B395
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download