796f60ea9f3ac7f8c73a34f166074c6c23b2a25c4cdc8214e8a4abb3c9b7ae75

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_992ebcf96f77eead67ac7c11e1733166_elex_mafia_stealc_tofsee.exe
Size 660KB
Sample260718-da4exahv2s
SHA256 796f60ea9f3ac7f8c73a34f166074c6c23b2a25c4cdc8214e8a4abb3c9b7ae75
MD5 992ebcf96f77eead67ac7c11e1733166
SHA1 b2f590298673ef256ba3861cedf17ab3c2ab38f0
SHA512 10136e9c392ef691958b950988abb4f28583fa319ec5bcbf4573d2816d67192ff1c5790796240a1202e43b4de211fa1457a2ea18640e66e9bed47fb48a5553d7
SSDEEP 12288:NO4rfItL8HP286+7XNuEr0hJ3bCXfEPnjalD7tx7qg3kdI4S47ioeB/nNTnVW7vj:NO4rQtGPs+7dulJ3bCXfqjalD5x7qg3i
TLSH
T1C8E4AF2BB3450373C2C203B12B4F99D7B72EA479137A95D225A8802D1767EB4D37B396
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
948	8A35.tmp

Executes dropped EXE 1 IoCs

pid	Process
948	8A35.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_992ebcf96f77eead67ac7c11e1733166_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8A35.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3360 wrote to memory of 948	3360	2026-07-17_992ebcf96f77eead67ac7c11e1733166_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_992ebcf96f77eead67ac7c11e1733166_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_992ebcf96f77eead67ac7c11e1733166_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3360
- C:\Users\Admin\AppData\Local\Temp\8A35.tmp
  "C:\Users\Admin\AppData\Local\Temp\8A35.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_992ebcf96f77eead67ac7c11e1733166_elex_mafia_stealc_tofsee.exe 7DEAB9F5DF4B79A1CADFD5F1EACE76AA5D9DCCC43A1A6BA22CEBD4D40C20A9A39B994CFB393C0D45EB331BEAF1E37F9885DC4308F6025C00C4FD10EC763B3287
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:948

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8A35.tmp

Path C:\Users\Admin\AppData\Local\Temp\8A35.tmp
Size 660KB
SHA256 ea2aaee3106c36b0d2c25cc32b3ba5b4c582a1df2d51606df794ac22cd37ccbe
MD5 4c04bf4fca7df13408b6afb452aa7014
SHA1 f7fb2771b0bf61371920a9e6a3339bf34f6fabb8
SHA512 70b0d12328920e64bef3cfdc2e13eecf270c7a80edc428527431686e20abfd942dec4ca283184890366ab73a1309f12358ed9c53380dbf0231deb722e9dcd66e
SSDEEP 12288:NO4rfItL8HPBN183t0h9sDuhD7tx7qg3kdI4S47ioeB/nNTnVW7vyk7:NO4rQtGPBN183tSsUD5x7qg3kdI4Z7ic
TLSH
T169E4AF2FB3450373C2D203B2275B99D7BB2E6579237A85D2246C802D1767EA8937B3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download