ae65ac27347761fb2d5a820397f6abc603f53647e64c1b9b05420702da17a28c

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 00:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_8f73827413b8d5d72e185a3ac9339bc4_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260718-bamq2sa15q
SHA256 ae65ac27347761fb2d5a820397f6abc603f53647e64c1b9b05420702da17a28c
MD5 8f73827413b8d5d72e185a3ac9339bc4
SHA1 cd323f39e074460a5e10e57f8e702bdd20c9e44d
SHA512 8b2b6845534eea6d0cbad9bf935f175e399b70a62ca50d960083d855b98fddf04c7e15d2f9a15733a673dec4b29d2d82dc50bdc8c4d594fd5b4a4a165115300e
SSDEEP 6144:b9EyS4oMxIkjxcWqHtg88HARRHXqP3e8mZZdtSc2+zm2OnC8r+PEwp+LuVWFiZ0Y:bO4rfItL8HAbLMf2MwEhLuVgO75UO
TLSH
T1EEA4F126B6818133E29302754FD6DB666A3E79750325E4C32BD802BD1FB1AE1D37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1268	4FDB.tmp

Executes dropped EXE 1 IoCs

pid	Process
1268	4FDB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_8f73827413b8d5d72e185a3ac9339bc4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4FDB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3284 wrote to memory of 1268	3284	2026-07-18_8f73827413b8d5d72e185a3ac9339bc4_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_8f73827413b8d5d72e185a3ac9339bc4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_8f73827413b8d5d72e185a3ac9339bc4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3284
- C:\Users\Admin\AppData\Local\Temp\4FDB.tmp
  "C:\Users\Admin\AppData\Local\Temp\4FDB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_8f73827413b8d5d72e185a3ac9339bc4_elex_mafia_stealc_tofsee.exe 39DB154EEC677A1219702D13D975310A406068E3B3DC75A1408E54246C7A6A143A17FB80168C8E911A396F7237A4D2DE23BB65FD368D7223AE3BB0D245F526A4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1268

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4FDB.tmp

Path C:\Users\Admin\AppData\Local\Temp\4FDB.tmp
Size 479KB
SHA256 7e17c3c0e81b9a4f6a166eefe8c413cbeae390442c4b2212c4e1df0b7280937d
MD5 ee306fd7438ce869dd972011db03b7c0
SHA1 8bf790ac13a2cdc2c58e9151e0d926c3ea6f2208
SHA512 7778b42cfad96f3cf9ed93c11f0913b3cca1a56bbd1294ac11f58721c9c80b5248acd1457bb2308a217f71d0fcb199f3cd2ca4872403a49480ce10df16f98d19
SSDEEP 12288:bO4rfItL8HAkfFXaalRi6PRKuksK5ak75UO:bO4rQtGAkfFK0iURTzkVUO
TLSH
T1C4A4F12AB641C133E29302714BE6DB96AA3E79741336A4C777D4027D2F616E1E33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download