4845f3f8cdcb66d72073a6ff8589022e426ba7eb070abaa16a7b09c79ebff11e

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_dcfce097a200c049a1ffaef645f6777e_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260718-a4fn6aex31
SHA256 4845f3f8cdcb66d72073a6ff8589022e426ba7eb070abaa16a7b09c79ebff11e
MD5 dcfce097a200c049a1ffaef645f6777e
SHA1 b05e71b7b25c01aed523cc35ecefd2ebc4d78db5
SHA512 166582fec4dcdb096649df208778c744c1c5e64d78e27c6d4880478773cfde4b71ca5f2b4e303a51d923bb7be391a91d783b0f9d791d2fa95f9af67333c11d1c
SSDEEP 12288:3O4rfItL8HPU43pElzPzLbRD/zge++KD7rKxUYXhW:3O4rQtGPB3pEFbLbVq+KD3KxUYXhW
TLSH
T155B4F1297681C233D2D302355BD6DAD6B63E78711766A4C337D8027E1F61AE1D33A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5460	473C.tmp

Executes dropped EXE 1 IoCs

pid	Process
5460	473C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_dcfce097a200c049a1ffaef645f6777e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	473C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2800 wrote to memory of 5460	2800	2026-07-18_dcfce097a200c049a1ffaef645f6777e_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-18_dcfce097a200c049a1ffaef645f6777e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_dcfce097a200c049a1ffaef645f6777e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2800
- C:\Users\Admin\AppData\Local\Temp\473C.tmp
  "C:\Users\Admin\AppData\Local\Temp\473C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_dcfce097a200c049a1ffaef645f6777e_elex_mafia_stealc_tofsee.exe C4F8CD80AA5B4E254E1F0BFECFC7F0CE64E1EAA4A1520254CDAC8AF69A53575EC8A5F6730CBF31BAF40B6E65B2D96D959DEB4E93F53541F8520E447D81B9CC4B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5460

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

473C.tmp

Path C:\Users\Admin\AppData\Local\Temp\473C.tmp
Size 486KB
SHA256 8cde50618fce02c33d9f654bdcf60f08af8006d9c848d0e0a08546b914875fb2
MD5 34de916cb92ff2562f96724318f57664
SHA1 65de93a8015d697599bc77c0495720e49c4106a6
SHA512 bf8071bf6e2b17b7ae853d1cf5f96730cebc04738b2c16940f76b445c155e5919a64cab7f9b8f13f2ebfb3e911e873078a8f1a2bd1e70d786ca554d609552179
SSDEEP 12288:3O4rfItL8HPQxaliLeJ/ve7r1ERy7rKxUYXhW:3O4rQtGPQxagyUray3KxUYXhW
TLSH
T16CB4F12AB681C233D19201755BD6DBD6673E79B10326A8C33BD8027D1FA1AE1D37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download