e28974306ae34370e53ac995207bf3d6343f2ad26a84bed31137c5bf6ce94bdd

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_9726f6b5b82fbf68761b2a38e1df64d4_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260718-db2byady6j
SHA256 e28974306ae34370e53ac995207bf3d6343f2ad26a84bed31137c5bf6ce94bdd
MD5 9726f6b5b82fbf68761b2a38e1df64d4
SHA1 7b8f3c972cf6baa21e57cd51b246e15ec144d61d
SHA512 a9c0b9eb6385d38405e10f9550dc0ee220a0843fd36fb1c2b6a0bdad75887cb56b60b53ffbd55147f2012c6e53935b4e6f4a5da94a0fd43372624c0bb6477066
SSDEEP 12288:bO4rfItL8HAPZqOaupo/G2qzKA1TT+60A/qvU4P75UO:bO4rQtGAPZqOau+/uzKEhivUoVUO
TLSH
T1B9A4F12672818033D69302714BE6D7AAA73F79B50736A4C33BD442BD1E656E1C73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5152	4414.tmp

Executes dropped EXE 1 IoCs

pid	Process
5152	4414.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_9726f6b5b82fbf68761b2a38e1df64d4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4414.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1284 wrote to memory of 5152	1284	2026-07-17_9726f6b5b82fbf68761b2a38e1df64d4_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_9726f6b5b82fbf68761b2a38e1df64d4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_9726f6b5b82fbf68761b2a38e1df64d4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1284
- C:\Users\Admin\AppData\Local\Temp\4414.tmp
  "C:\Users\Admin\AppData\Local\Temp\4414.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_9726f6b5b82fbf68761b2a38e1df64d4_elex_mafia_stealc_tofsee.exe F78F267712C5C30AE20E468729E8D89375BB0706DC25910108D70637CE139835D1E933767A36780DCFE65256F44D24949CE8DCB33FA629BFA406E78C0B5AB6C9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4414.tmp

Path C:\Users\Admin\AppData\Local\Temp\4414.tmp
Size 479KB
SHA256 035a15d7863e2651de216009b1b16a1d7f9d794c087f30f70e42cb8871885574
MD5 086b3825bce74002f8eea0c49b20013e
SHA1 e89597d766514042565f9db858e95361929ced15
SHA512 0bac28be73313769d64d15c2d85e9638c8e3c2255b962d60080facbeff8783afc2b905c45543c3380f4f2d7cd3811b8971f3412bc806090c76bf6784769d1b11
SSDEEP 6144:b9EyS4oMxIkjxcWqHtg88HARRBOe052vDze6EJjpl5Vq5ZLjopfNduZyFf75UNY:bO4rfItL8HAVzRWll5Vqop1duq75UO
TLSH
T14AA4F02AB681C133D29301750BEAD7AAAA3E79B41736A4C33B94027D1F647D1D73A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download