023bc54ecc93bd5c2f2c2a42813b7f4c9613885f7c249e733f0bf46b6c510e18

Analysis

max time kernel
148s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_2fbcece6103086e1f71d0bb5c52a39ed_elex_mafia_stealc_tofsee.exe
Size 613KB
Sample260718-ez7pasgs7r
SHA256 023bc54ecc93bd5c2f2c2a42813b7f4c9613885f7c249e733f0bf46b6c510e18
MD5 2fbcece6103086e1f71d0bb5c52a39ed
SHA1 840165a6757293c5148619f57580b7d61ab63bcb
SHA512 adb2850f4087162690391f115584c6eb06c6c291243177a8d9cfffcbda921f1d43f09e4ee8f3b95fcb848099f9cd974f04196cce82e46278f3ee5f892491c8fa
SSDEEP 12288:XO4rfItL8HPCwrIWtgcT9tVeqSNN7Q8mO4rfIt+2:XO4rQtGPCwrhtgI9tVePNdmO4rQt+2
TLSH
T196D4E1257340C037D2A6113597E3AB69567E7EB40B12A5C33B8427BD2EB02E2D77934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5800	746B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5800	746B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_2fbcece6103086e1f71d0bb5c52a39ed_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	746B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 5800	4684	2026-07-17_2fbcece6103086e1f71d0bb5c52a39ed_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_2fbcece6103086e1f71d0bb5c52a39ed_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_2fbcece6103086e1f71d0bb5c52a39ed_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Temp\746B.tmp
  "C:\Users\Admin\AppData\Local\Temp\746B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_2fbcece6103086e1f71d0bb5c52a39ed_elex_mafia_stealc_tofsee.exe DB2A3E5D6E933AFEC5AC4BD204A1692133D5F74CEC18DE6040DDFF93340057017F258585D33CF004FD05FE1327BB7A278DE40DBC5A2A7066BD0C2E58B178E9AC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

746B.tmp

Path C:\Users\Admin\AppData\Local\Temp\746B.tmp
Size 613KB
SHA256 a8fe4724c1d07d1a373cfe2527a36d5fc9f988b61c15d53884e85e71b179bd13
MD5 3992c531fca852381f72c6c84c9ad4bb
SHA1 15055c1882ce6240b5a96992c316a99aa47d0ff5
SHA512 351bbada04398bf5ce506d2ff481e7ec57799d92e4565ca07b56173b7f3c5bf4a7ca2c4d756bfefbff3def257f35b791a0154721ce37e71fbb746a95c0e7d107
SSDEEP 12288:XO4rfItL8HPOMmRQ5FfHa3a0TRqu647Q8mO4rfIt+2:XO4rQtGPO5RQDaK+DdmO4rQt+2
TLSH
T1B0D4E025B340C037D6E622395BE7E769567A7A740B12A5C33B80277D3EB01E2D73934A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download