6ac236f7228865f4cf0980e3db8b4d9b4537f9ec3bab6a8be06d4cfd0eb1db76

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 07:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_783f5c8d1178a9a05fca56c95ccc839c_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260718-jcn1wsct2p
SHA256 6ac236f7228865f4cf0980e3db8b4d9b4537f9ec3bab6a8be06d4cfd0eb1db76
MD5 783f5c8d1178a9a05fca56c95ccc839c
SHA1 729f28e3caa63403af32f2e3128fffade96ee213
SHA512 c58498b4527caec1da83d003cc6cb8994456dd95a5adcc2ce3ff7707492d4994cda81af0849b232d5d1098bf5abc92d3b865fb6a4f00a92511029f49cf6b33d9
SSDEEP 12288:3O4rfItL8HPya5bf8kAfQXBaWqdmWfu9h7rKxUYXhW:3O4rQtGP9B/7RNWMh3KxUYXhW
TLSH
T113B4F12676418233D19302711BEBDAD6B63E74B11766A4C33BD8427D1FB1AE1D33A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
428	FFC7.tmp

Executes dropped EXE 1 IoCs

pid	Process
428	FFC7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_783f5c8d1178a9a05fca56c95ccc839c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FFC7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1824 wrote to memory of 428	1824	2026-07-18_783f5c8d1178a9a05fca56c95ccc839c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_783f5c8d1178a9a05fca56c95ccc839c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_783f5c8d1178a9a05fca56c95ccc839c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1824
- C:\Users\Admin\AppData\Local\Temp\FFC7.tmp
  "C:\Users\Admin\AppData\Local\Temp\FFC7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_783f5c8d1178a9a05fca56c95ccc839c_elex_mafia_stealc_tofsee.exe 810A7F58B0F9650A3B7FB2CCD27BB5CAC707E29B6C925EB62E839688615FAD77C144802D319906B7DEE603E64156F4ABF69B189EA70D87058A7BF94949FF7C53
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:428

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FFC7.tmp

Path C:\Users\Admin\AppData\Local\Temp\FFC7.tmp
Size 486KB
SHA256 87ce9a362a42ab33d8dec985da1af3adf7674d91a62051b8a9c23902979a22cb
MD5 0815a3a6c9b180a353c596c520d408dc
SHA1 160f83167c751a0afff1e797265eac3d56e7ae5b
SHA512 6d6aaae8b8ce766f0ba2fee68b9eb35b0df433d09f4b401751645056e0a59a18b3d16851b7c5560e02b308171da08cca024f9f8f58610e3c4ff948cfcfc021fd
SSDEEP 12288:3O4rfItL8HPSnc5e1YebT15tLDmQDkmT5WCmlg17rKxUYXhW:3O4rQtGPKwebT15tLDmQ9W/s3KxUYXhW
TLSH
T13EB4F12AB6818233D19302751BDADB96B73E74B1072994C33BD8027D1F656E2D37A387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download