b697f29eed997ac1eea63a2551fb3a57784249cb28ca7c5947a01705be19e712

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 11:39

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_2ba2f828c091e7784da376f7dc198ad6_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260718-nsppksas4j
SHA256 b697f29eed997ac1eea63a2551fb3a57784249cb28ca7c5947a01705be19e712
MD5 2ba2f828c091e7784da376f7dc198ad6
SHA1 cb582f6e80c72712f7ad14047c9476c7d7484e15
SHA512 5b26fd947a5e67b4e3ea1d731323fe28b3ba1a5335ad8edcdd08c404f0524469fa8c83db3066dfac5a2010111333e971294af19cc8036ae84de8ab6e0f6bb09e
SSDEEP 12288:Wq4w/ekieZgU6vnElHlt3RZYzysW1yBlMa:Wq4w/ekieH6vElTRZYzlWkP
TLSH
T1DCA4D0213682C036E1A716354AE6CBB9153DBD614F71A5CB3B943BAE6E706C1DB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3748	7D6.tmp

Executes dropped EXE 1 IoCs

pid	Process
3748	7D6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_2ba2f828c091e7784da376f7dc198ad6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5036 wrote to memory of 3748	5036	2026-07-18_2ba2f828c091e7784da376f7dc198ad6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_2ba2f828c091e7784da376f7dc198ad6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_2ba2f828c091e7784da376f7dc198ad6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5036
- C:\Users\Admin\AppData\Local\Temp\7D6.tmp
  "C:\Users\Admin\AppData\Local\Temp\7D6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_2ba2f828c091e7784da376f7dc198ad6_elex_mafia_stealc_tofsee.exe E2C7B186EA4A4BF40F6D5B176CC01D899C2F4609AF7EFDA5ABA8D1C5D4A04C8D6B7D5A885B4917BD5B1D0EBAE1F77DDAB3C3675F6B45A34E3EE48C04AF328733
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3748

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\7D6.tmp
Size 443KB
SHA256 d2f7542ddc60b07cb754c63547cf0288f4896bd29f94eac80a1ae37015e58b51
MD5 626af67dfa01803c9c84410ef0810582
SHA1 639a29a103faac3143366f82e02d7600ccd9cac2
SHA512 6fdb801b7988f56ad0ffc9843574f38b6d67e39cd7a088f6ac0bbaead3d8c9e7c58657fa2765edebd8fb02a9f30e4d5456a1ac03c46a84c98bc907e45117e494
SSDEEP 12288:Wq4w/ekieZgU6r8Kjcl34QA3MKkxEqh2GwC/lMa:Wq4w/ekieH6IKjc14Q2MKDqAC/P
TLSH
T1E7A4D0243582C036E2A7063446A5CBB9563ABC744F72A8D73BD43BAE6E746D1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download