52935d01bdb64bf6afc83ea4e87468eca082707d0fdc94bf4e258b684130f90d

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 06:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_99ca5e8ceee3ce7531ed95c82c87dc21_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260718-hr8heaez2v
SHA256 52935d01bdb64bf6afc83ea4e87468eca082707d0fdc94bf4e258b684130f90d
MD5 99ca5e8ceee3ce7531ed95c82c87dc21
SHA1 b3eb62aa95bcccaeeac2c2cf600744c2d0359aac
SHA512 faf3ea26cf9df0ea17e0fef85af87d0a6b3b82e7415fc82777a100bf438f18914d2aa2590f128d224977a2ed495bab68926ea73696a13ef604d00548cc0e48e9
SSDEEP 12288:aO4rfItL8HRCht/8i9raAFpscroQqm7K9wlsDpVFd:aO4rQtGRmN9raQ8Qqm+9wlsDpVFd
TLSH
T19CA4F13A76818233E29301751BD6DBAAAB3E79B0172694C377D4023E1F216E1D77A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5908	80A0.tmp

Executes dropped EXE 1 IoCs

pid	Process
5908	80A0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_99ca5e8ceee3ce7531ed95c82c87dc21_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80A0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4880 wrote to memory of 5908	4880	2026-07-18_99ca5e8ceee3ce7531ed95c82c87dc21_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-18_99ca5e8ceee3ce7531ed95c82c87dc21_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_99ca5e8ceee3ce7531ed95c82c87dc21_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4880
- C:\Users\Admin\AppData\Local\Temp\80A0.tmp
  "C:\Users\Admin\AppData\Local\Temp\80A0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_99ca5e8ceee3ce7531ed95c82c87dc21_elex_mafia_stealc_tofsee.exe A313D60E0BF163143BA65141DF9C64D94D34E48CF5036027D6141E49A92CAFD2011E902379DFEFE7B840CA41FF1176216A9208CDEE7176B9C804CE0EE352A66B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

80A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\80A0.tmp
Size 476KB
SHA256 aca761347c3aa47b3a332fa78533c4c9aa36720c84470565d846b1b17c7c551d
MD5 6e9e7c29b58d3bafca3e9b9e2cdae867
SHA1 e77c84023067e29d394d4fed3fe627772646ea75
SHA512 dd523a67a71603ce1775875002ad57ef779116d82273994172fa946f6b68e706decb3d96187542010e99816acbe06b4d99040f0436f25710e21de6479894adb4
SSDEEP 12288:aO4rfItL8HRrQPwxE86q0oV1acvjp80WH+17K9wlsDpVFd:aO4rQtGRrQIxENq0Y1Pjp80We1+9wlsL
TLSH
T1BCA4F1397681C233D28302754BDADBEAA63E74B5432694C37BD8026D2F64AE1D376347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download