e9a68839f47e79d0fcfe81e0ee0ab7c763e71dbef2ab47f4aeff534d98f3ca3c

Analysis

max time kernel
148s
max time network
141s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_a5408ba215a7b0f2b79eb13b7dbe50ff_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260718-c5frnahs4x
SHA256 e9a68839f47e79d0fcfe81e0ee0ab7c763e71dbef2ab47f4aeff534d98f3ca3c
MD5 a5408ba215a7b0f2b79eb13b7dbe50ff
SHA1 d5ef5442aed244b22a2ef50b787d34ff19465388
SHA512 d54b041fa72e094d7400c9b844ad723efdc56069651f881f513b4c9b3767be1750674c55002589d8effdd54c313ede5b557ae7acf5e3565826823b89b73989da
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYpH0fDUoYxZ3q8Ec1gC5LQyPV2Lq1Lxw9J:fd4x+ePixnXQjy0sxM84C5Sq1dwP
TLSH
T13594E0213582C03AE1E606388AF4CB69596A7D704B36A8C777D42BBE6F701C1DB3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2756	7BDD.tmp

Executes dropped EXE 1 IoCs

pid	Process
2756	7BDD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_a5408ba215a7b0f2b79eb13b7dbe50ff_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7BDD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 2756	2776	2026-07-17_a5408ba215a7b0f2b79eb13b7dbe50ff_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_a5408ba215a7b0f2b79eb13b7dbe50ff_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_a5408ba215a7b0f2b79eb13b7dbe50ff_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\7BDD.tmp
  "C:\Users\Admin\AppData\Local\Temp\7BDD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_a5408ba215a7b0f2b79eb13b7dbe50ff_elex_mafia_stealc_tofsee.exe 0AA248B03DB161CAC6D256DB902464B209118DD0DF9226E5851A55D739F281C677211580BD189F026907E2B82A0320D1FA91C7336D9BD7CBC5DC553FFC8ACD96
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2756

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7BDD.tmp

Path C:\Users\Admin\AppData\Local\Temp\7BDD.tmp
Size 435KB
SHA256 730e824df10c126f3a3f84ec22f49d8e24003ad2646c6e8141bbf4c0e6d3048a
MD5 7be8ec0d7634eeb7f960f1d7e85f4c51
SHA1 8a669c10dd978a2cd89b019bec85081214a9cc91
SHA512 e863196155c438f7c4c2760177f5d36f4e0c318991b9dc666ce5adb40b11f965afc84a91554ba05fabe299ed64e403f3605da0d97d781c56d15b616661a47f15
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYolFZjuqJv9BT2tj2PhNi+hU65JoFXw9J:fd4x+ePixnXQjft7ijKtUHXwP
TLSH
T1CA94D0253582C037E1A706344BE5DBA96979BCB05B36A4C73BC42BAE5E702C1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download