6a03b9f1d921d15975aee2114e30aa51aa75c265ae5c7e410f76e42b50666b34

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_0942b0702fc33d4eeedb597ec776594f_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260718-bmqcpsft6s
SHA256 6a03b9f1d921d15975aee2114e30aa51aa75c265ae5c7e410f76e42b50666b34
MD5 0942b0702fc33d4eeedb597ec776594f
SHA1 01f3866bcd2724e14015378d9f9e44f9ed12164d
SHA512 bfe5958d1bf940e19f603d2150088f5d5dcc6ec08ab0d65124055a7f09e05ee9331929918fe09f3b579f8fe602274bdaa45bd8896fe8f614c47e9cd3412da69d
SSDEEP 12288:Ci4g+yU+0pAiv+10XsBRRDZjbXYsqmD/RVOAJyZ6:Ci4gXn0pD+m6Lj7jffOxZ
TLSH
T1AD94F1303142C033E2661A344FE5C7266A7E79B54726A8CF3BD41BBA6E607D2D67434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1948	167C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1948	167C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_0942b0702fc33d4eeedb597ec776594f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	167C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5460 wrote to memory of 1948	5460	2026-07-18_0942b0702fc33d4eeedb597ec776594f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_0942b0702fc33d4eeedb597ec776594f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_0942b0702fc33d4eeedb597ec776594f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5460
- C:\Users\Admin\AppData\Local\Temp\167C.tmp
  "C:\Users\Admin\AppData\Local\Temp\167C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_0942b0702fc33d4eeedb597ec776594f_elex_mafia_stealc_tofsee.exe 91E806BD8647D3273382AB31659AB4DE03DC0E93D0A6F2C3B4F26CA955A2AE86AD3033135BDD994803BE0DCEB5E7939FFC934D9B0DECD1DF499E85B7D7447F3A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

167C.tmp

Path C:\Users\Admin\AppData\Local\Temp\167C.tmp
Size 433KB
SHA256 dfa6f2b8cc5fe4e1c5e05168a779f8df50b8579dda28cd113e19b75e93e3a865
MD5 b578fcebd072bc2f8e80763460ae4b04
SHA1 ccdde38df85f47fdfd5017ebf884e2c56656a7d1
SHA512 244de4706ef33cb422af96af4b8943651b9060794051b1736f4da6cc48cbe241020bc3a52a2ad2ec54705a05ae1fed54bc1e8a8e7c4710a9d8b187169fc59412
SSDEEP 12288:Ci4g+yU+0pAiv+eO9QvYOSqo58sHfryLd7jItL:Ci4gXn0pD+eOev1RC8efrht
TLSH
T10794F1203592C033E6A716344BF4C765667E79714726A8CB7BE40BBE6EA02D2D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download