4f39af4bbf6e7498551261aa263c4bd7b3b6f0e5a783fde3ea13e1682a0e1ec9

Analysis

max time kernel
150s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_e0477f39360930a9858f5c5b7ccbf9bf_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260718-b6f85scs9m
SHA256 4f39af4bbf6e7498551261aa263c4bd7b3b6f0e5a783fde3ea13e1682a0e1ec9
MD5 e0477f39360930a9858f5c5b7ccbf9bf
SHA1 d987e861915738b044dce40ca2924c462e48fd75
SHA512 ca5c765ba3d0580c1ac37ef68609ce4657a1d1091e10b8f50919c6e5b1582e7b450ca051c64ed635b7fc61b2c033184c1a1aa376030e18b52b563aa19679b378
SSDEEP 12288:bO4rfItL8HAKyZGBJ8G1aVD975M/ua75UO:bO4rQtGAKkGBgH75AuaVUO
TLSH
T18BA4F13A76818133E69302751BDADBA9AA3E78700336A4C337D4067D1F616E2D33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2972	9011.tmp

Executes dropped EXE 1 IoCs

pid	Process
2972	9011.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_e0477f39360930a9858f5c5b7ccbf9bf_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9011.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4260 wrote to memory of 2972	4260	2026-07-17_e0477f39360930a9858f5c5b7ccbf9bf_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_e0477f39360930a9858f5c5b7ccbf9bf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_e0477f39360930a9858f5c5b7ccbf9bf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4260
- C:\Users\Admin\AppData\Local\Temp\9011.tmp
  "C:\Users\Admin\AppData\Local\Temp\9011.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_e0477f39360930a9858f5c5b7ccbf9bf_elex_mafia_stealc_tofsee.exe 864569352DAFD2A30F25EB29CD4B2F0C9DE82B4BD13ABB6D7D83863116E04D800030E4394353F7FCF726F011FBAA4F9ADEA68241208941850CF5685C7470FC90
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9011.tmp

Path C:\Users\Admin\AppData\Local\Temp\9011.tmp
Size 479KB
SHA256 74e846e70351a84ea1e6d588502e908c2c717dad4dc9b3a24c59e660b6e2827e
MD5 ec20f6f52f2e0779e5d215a26cefac99
SHA1 78cdfa95ce9525ef65be1c45188fc7c7e0874595
SHA512 6e2c9a7e5cd69b81afa16f0cc6ef188c32831686c34263f3c097a30715d8b8b696a8a3971548c98a8026c0b1e877a8ecc31716b90e0ed597d100d7f7947e099f
SSDEEP 12288:bO4rfItL8HAQkoNgzgDIhkxk9IOWQRTUrG9w75UO:bO4rQtGAQkojDzxk0rG9wVUO
TLSH
T1ECA4E13AB7808133E29302741BE69BA6673E75B10726A4C73BD4027D1F656E1D37A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download