19a6f5e2f1964c5f604ed42ca249b00d5c9861f2d389e0a1626a07c114526fd3

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_61a7de38a648f84a4e7a978bca2071bd_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260718-d65b3sav6t
SHA256 19a6f5e2f1964c5f604ed42ca249b00d5c9861f2d389e0a1626a07c114526fd3
MD5 61a7de38a648f84a4e7a978bca2071bd
SHA1 9253ee0724a0c29e44d080eba78583f09be2c32f
SHA512 6401e23509b79cda1c1fc6db98fe96742df79b981508aad89be5c9ee1f5293ea319e0f65d0604645745d4e3c4927b6d6568d67d7fb7e5020d6d7c9bcca09008e
SSDEEP 12288:qO4rfItL8HGomqxUUAj8bZcaODIa/Kf67bWmeEVGL:qO4rQtGG1go8sKf6umeEVGL
TLSH
T16FA4F0267642C133D19212351BEAEBAAA73E76B10326A4C33BD8437D1F656E1D33534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4152	4750.tmp

Executes dropped EXE 1 IoCs

pid	Process
4152	4750.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_61a7de38a648f84a4e7a978bca2071bd_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4750.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6112 wrote to memory of 4152	6112	2026-07-17_61a7de38a648f84a4e7a978bca2071bd_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_61a7de38a648f84a4e7a978bca2071bd_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_61a7de38a648f84a4e7a978bca2071bd_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6112
- C:\Users\Admin\AppData\Local\Temp\4750.tmp
  "C:\Users\Admin\AppData\Local\Temp\4750.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_61a7de38a648f84a4e7a978bca2071bd_elex_mafia_stealc_tofsee.exe 4D2002ABB8234CD6A2C87A8F0D5201639CF95422922597F8BCDF9A29E53134DB1E2A829D7F024758764B69802F7938F7B9BE410D2828DFB44300940CA1ED9F15
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4750.tmp

Path C:\Users\Admin\AppData\Local\Temp\4750.tmp
Size 468KB
SHA256 74b076971a78770df17f8f00e34af2e8d99ebd2454d36acbfe24107ba3b42046
MD5 d09fcbf1acd16ac79ea10aae371b5331
SHA1 a9c26da3df7bf35796e322c0ee6963e1b3d359a0
SHA512 5d742f97f23bd8cc04353bff8d7de08290e65a664cab0c44c9092bf6a39d2d54cc0ed1d262a6b3f779e28a30ba13b6ee4a858d2023c371be6c4d961f98eac60b
SSDEEP 12288:qO4rfItL8HGmvl0dKe2bxI1BvXzTrPK7bWmeEVGL:qO4rQtGGSl0dKeSiXzT+umeEVGL
TLSH
T1EFA4E03A7242C133D29312741BEADB99BA3E75B4432698D32BD4027E2E657E1D336317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download