cf0ef457bb0d6551fb55545218df9c095582ccb7b3daa19f965eefc0c2123bd8

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_26f3ca3ccb69540a502be417fba4c107_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260718-e5h8wsgt9j
SHA256 cf0ef457bb0d6551fb55545218df9c095582ccb7b3daa19f965eefc0c2123bd8
MD5 26f3ca3ccb69540a502be417fba4c107
SHA1 5b5c2b482878eea40a7074d7e7a00a7ec51a7611
SHA512 ffc12912793e258413a4a3ea9b265851cb641ea2b05dc6e000d986985dbd3599048313270f13765fbd8791ee21356363028fa5ed640db554917192e747b94a47
SSDEEP 12288:fd4x+ePixnXQj1Xx9+7sbncSbudK61JauYyLGa96kwswP:fd4x+ePixAj1q7Erud3TrYz7s
TLSH
T1AA94E0213286C037E1A206344BE5DBA9A93D7D714736A4CB3BC427AA6F646D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2172	572E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2172	572E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_26f3ca3ccb69540a502be417fba4c107_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	572E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 2172	4532	2026-07-17_26f3ca3ccb69540a502be417fba4c107_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_26f3ca3ccb69540a502be417fba4c107_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_26f3ca3ccb69540a502be417fba4c107_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\572E.tmp
  "C:\Users\Admin\AppData\Local\Temp\572E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_26f3ca3ccb69540a502be417fba4c107_elex_mafia_stealc_tofsee.exe 3F2620B96C02FAAB458E3FE1E9604DF86C18789AC97B5521B16DF97518AA0E592FE01971CF4C6DC417C98542F0B9B5126E84E00202C0038DD86FC78795B41734
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

572E.tmp

Path C:\Users\Admin\AppData\Local\Temp\572E.tmp
Size 435KB
SHA256 27a499e5b0845a9d1fc59b19ed12a9a0cd8a0fd9578a5127055e1b01a60e759c
MD5 d3f75a3e2be7eadaf4605a50a98d39cd
SHA1 bff640a951bbe9bf1c030b30a605ebe5b8155b95
SHA512 0ad82f9ddf7b3796914f7185a9d0bf751b351efd332206cc0fca233f252387fd067221678d1b52eae3e4bddc959f0748ceb42f499676d1c11e836ecdb5cc4d24
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYBP8i36AYlwSy0l2n9ViCsgx5Jbhw9J:fd4x+ePixnXQjcPilwlViXCJ1wP
TLSH
T18494E1253586C037E2A70A348BF5CB6955397DB14B32A4C73B842BAE9E742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download