d32914effa4be0398e275d0968da2ea9dc40d77a47f290d0e7004f0c9c24b0b9

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260718-maxrssbt6y
SHA256 d32914effa4be0398e275d0968da2ea9dc40d77a47f290d0e7004f0c9c24b0b9
MD5 da39478329362aa2000c9d490a3823bf
SHA1 a9d821fe2e43b4b56c3348f166bac283160adbe7
SHA512 0b88b959edfd5bf229bc195217a370b76d28fd50ad0e5eff2f3070884b79b689ccf654500e1d0b6d2a274a9d98dc3bdb9e30464e591a014d587e851323e2a471
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYXfj8QyREfX2fIa6H4DId1qmvDUruqNU1lMa:Wq4w/ekieZgU6s8ntIBN1xbuNmlMa
TLSH
T1CDA4DF217586C037E1A702348AE5DABA1A7A7DB14F71A4C73BD437AD6E702D1DA3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1328	F5E4.tmp

Executes dropped EXE 1 IoCs

pid	Process
1328	F5E4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F5E4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 1328	2608	2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\F5E4.tmp
  "C:\Users\Admin\AppData\Local\Temp\F5E4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_da39478329362aa2000c9d490a3823bf_elex_mafia_stealc_tofsee.exe AF8295BD35EE8947E0E59FA790D4E44EDA35A1A8D5B758D82BAB7DEE81F9FB4712D4FF42516CD9F84F7E5FB9A4037E18C7FA4371A38E3953839B6B35C4ABDA66
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F5E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\F5E4.tmp
Size 443KB
SHA256 a1f6b48c6dcba3db1f80fc547f0cdd3caa8b3419000d6797e4e9477f8b825b64
MD5 604dfd6f7592ef4fcac26c8fee146932
SHA1 a7cbbe292af61f522c6454c15d6a668f6887d8de
SHA512 f11882051e24d5bf2ecd76bcc8348ca52d23cd27ff27642952587c8ea1d25d1d5a9e3c6f58278fd624df2e465264c57abf6637496df392a8d8ad2820651d2cff
SSDEEP 12288:Wq4w/ekieZgU6YAO/SlHCl9wkjZMmXzEsAxy36lMa:Wq4w/ekieH6M/aClPXz9oP
TLSH
T1E6A4DF213586C076E1A6063487E5CAB9563E7CA15F72A8CB3BC437AE6E716D1CB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download