2a78e842a9eb4bcdedfe2d70f35a8b7515998b27e344a48380c9254bde73311e

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260718-d2mapsat4x
SHA256 2a78e842a9eb4bcdedfe2d70f35a8b7515998b27e344a48380c9254bde73311e
MD5 6957adeb8d3ec1a8d431b959c5b915e6
SHA1 d9aacc20eb2fa6b2c6951e16998b389432cc5a57
SHA512 7abc14eb9e6873ba76fc608eee88a23261fdf99d02acf528a5c2b1a80198302f0d662637f6bbc1cc3b86068536b6f322c1cc141c2d681c21b0793ea223ca26c5
SSDEEP 12288:Nb4bZudi79LoR9Y1hj4bUg+c1aBYdnWGA:Nb4bcdkLHhjGT+cQOdW
TLSH
T1D2A4F0247182C037E1A716394BEAC735667E79A14B25A8C73BD42BBE1EB03E1D634353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5940	8B10.tmp

Executes dropped EXE 1 IoCs

pid	Process
5940	8B10.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B10.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5156 wrote to memory of 5940	5156	2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5156
- C:\Users\Admin\AppData\Local\Temp\8B10.tmp
  "C:\Users\Admin\AppData\Local\Temp\8B10.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_6957adeb8d3ec1a8d431b959c5b915e6_elex_mafia_stealc_tofsee.exe 227C0FE4C9CC42430BCFBE28D5B52B1F92CC26FA5297A12BD0343713D1EA95CD368B36904BC3016DB3706F5234F1D648CD38BEA9CE72083BC0E14D605ACDDEB9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B10.tmp

Path C:\Users\Admin\AppData\Local\Temp\8B10.tmp
Size 444KB
SHA256 f9198daf28ca1ccf97b355725acc2bab4e797f9f83a68208e0b63bc88775315a
MD5 ab62f4435d095695147214f02e45344a
SHA1 9cc8d107287092722909c5eb24ee62ef1522c60c
SHA512 ffe82638dc0952e1e2aef0176c0ca5ffc54113decc786ecfc8a2329496f4bbe55d49e430b8d2451b41633e21b90bc14974fcf26d9a559d6e256716e9e15a9fe4
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStZQDkEQInyrJTrX00oBudnZW/nNXZE1ff5v9:Nb4bZudi79LuQDknrO0Auv2ntkh6LTA
TLSH
T1DEA4F0293582C037E19705380BE5C766657E7DB15B3268C73BD46BAD2EB02E2E634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download