02e867b351c7ef58292200bf6fb21650ef867c27bab5319e7daecb743d718fc9

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_b3bc3beebbc9245e2b5266dbcf496cf9_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260718-mlzersbx9z
SHA256 02e867b351c7ef58292200bf6fb21650ef867c27bab5319e7daecb743d718fc9
MD5 b3bc3beebbc9245e2b5266dbcf496cf9
SHA1 a3f5ca501ec5c630f5dec43fc3e987f965b67711
SHA512 b0fe6b65c675a0ef537bf19c0903138a243ddb5c6d4a693a5f2b986bbdcdd5bc76fe81bf9e27c70d0fb0a9a83ab1220b46f0a09b8cf94e2ddad3ae0b09e5a5e2
SSDEEP 12288:Nb4bZudi79LlEOMOR+DQVeEHfQvEmIUfD/A0a:Nb4bcdkLOOMOR+EcEHQu9
TLSH
T102A4E0203182C037E1A716388AE5D7B5663E7DA15F6268D73BD037AD2EB02E0DA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1224	6603.tmp

Executes dropped EXE 1 IoCs

pid	Process
1224	6603.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_b3bc3beebbc9245e2b5266dbcf496cf9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6603.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4404 wrote to memory of 1224	4404	2026-07-18_b3bc3beebbc9245e2b5266dbcf496cf9_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_b3bc3beebbc9245e2b5266dbcf496cf9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_b3bc3beebbc9245e2b5266dbcf496cf9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4404
- C:\Users\Admin\AppData\Local\Temp\6603.tmp
  "C:\Users\Admin\AppData\Local\Temp\6603.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_b3bc3beebbc9245e2b5266dbcf496cf9_elex_mafia_stealc_tofsee.exe 099C0EC224AA73D9AF6647097F047CC3EA1BE36FD0D680D2A1EC4425C3CE0C9DE86A6B0D3A47EE6423CFAE1ADC60FDDECD1A059081BD5AB884AFB6267BE83B66
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6603.tmp

Path C:\Users\Admin\AppData\Local\Temp\6603.tmp
Size 473KB
SHA256 b90d71dea0c7720d7e3c3da4a7c84462653b472505447ea48bf375429e312e05
MD5 c460d8510e859855f3ae09ebde4b49c0
SHA1 d5657274817c57f431d6406d11cf9756ed47f55b
SHA512 a8c345f8b8b45852067350c3773ca7917fbcc6467643681ea27c70373c08786589a98f78b590fb62c44d48c56d763810877a8f9ff64298094c3581515be5ac64
SSDEEP 12288:Nb4bZudi79Lfs5ws6DHwv5jBStq2DhaOgOmJA0a:Nb4bcdkLfs16DHGj4nDIy
TLSH
T155A4E0243582C037E1A712354AE6DBB5567A3DA18F2168CB3BE077BE5EB42D1DA31313
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download