f14589ca8599f89baebfede74895831445c3919edee1a7440db854e69cde63c9

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_57990e2c694a9d6d97c79b3527f8076f_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260718-eczeeaft6n
SHA256 f14589ca8599f89baebfede74895831445c3919edee1a7440db854e69cde63c9
MD5 57990e2c694a9d6d97c79b3527f8076f
SHA1 50b14179be5b63510cda812d7446ad9f228aa77c
SHA512 039e336ab4ea823485dec3467befc2a4c9c7f003d69b4d74ff7e99c2304c8e1bbc863e5248d63e7ddf0f6ec0a567acbf8d3b34e8c70b4353c825411886a7d387
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBY8ZGcVm5QLsIX+1WzP5sK8gK5opJf4Gw9J:fd4x+ePixnXQjfBVeIU40op+GwP
TLSH
T12694E0307686C037E5A706348BE5CA69193ABD700736A8C73BD02BAE6E742D1D73535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1568	552B.tmp

Executes dropped EXE 1 IoCs

pid	Process
1568	552B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_57990e2c694a9d6d97c79b3527f8076f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	552B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3664 wrote to memory of 1568	3664	2026-07-17_57990e2c694a9d6d97c79b3527f8076f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_57990e2c694a9d6d97c79b3527f8076f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_57990e2c694a9d6d97c79b3527f8076f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3664
- C:\Users\Admin\AppData\Local\Temp\552B.tmp
  "C:\Users\Admin\AppData\Local\Temp\552B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_57990e2c694a9d6d97c79b3527f8076f_elex_mafia_stealc_tofsee.exe 60B9F80CFEDEA231ADA4CA42EE7C771B0C0DBE4ED5869CF09CB4117110A98445A35BE9C7E29473B1E9DEA6A4C30D9BE11DA5C70599C3A9B2F80239BAA2517AB9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

552B.tmp

Path C:\Users\Admin\AppData\Local\Temp\552B.tmp
Size 435KB
SHA256 e776d22a52eca0fede44ba37d9c4103e3f724382a705c1b7d49ebe466a3edb01
MD5 457ddaab7044ce24e523d825fa9c5cec
SHA1 2583737c32fd554ce503eb34fd7061b433ba3ae8
SHA512 1e815001a27a235d749be891e20f0efa4d2824ca48922823af303de5f7aef093ecd3e434156ddcd90291d243fff9b950490bc6e2d3b527a2a3ec61a170741488
SSDEEP 12288:fd4x+ePixnXQji5Wxo/dz2sOe9Mz/e5/RvwP:fd4x+ePixAjyWW/dz2sj9s/e5V
TLSH
T17094D0213582C037E1E606384BE5DBA9593A7DB50B35A4CB37D02BAE6F642C1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download