bfa2f1ce3898c7d4fee97a26695c3634a70ddf4eb98163ff067dc8eb95f70430

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 01:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_a302eb89e87b53981114c6d09c943485_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260719-b8f16ahs3n
SHA256 bfa2f1ce3898c7d4fee97a26695c3634a70ddf4eb98163ff067dc8eb95f70430
MD5 a302eb89e87b53981114c6d09c943485
SHA1 391e5364ddf8bb3702347332be9a434921881875
SHA512 e87301aa0c51624352124b959291299b5145d31e331c51ce28728aad1683d6d0805ba38cdd0a3b08ea478afdc33970b08f960362811f6000e252a166783ed619
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6zmih36fVtFwtP+U0qjIvwHwcuzBfAMe0w:Wq4w/ekieZgU6V3IQ+JqjJKNw
TLSH
T19D94E0313586C03BD2A716344BE1CA6A69397DB40B32A4C73BD42BAE6E742D1DB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1900	3AAE.tmp

Executes dropped EXE 1 IoCs

pid	Process
1900	3AAE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_a302eb89e87b53981114c6d09c943485_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3AAE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5832 wrote to memory of 1900	5832	2026-07-19_a302eb89e87b53981114c6d09c943485_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_a302eb89e87b53981114c6d09c943485_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_a302eb89e87b53981114c6d09c943485_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5832
- C:\Users\Admin\AppData\Local\Temp\3AAE.tmp
  "C:\Users\Admin\AppData\Local\Temp\3AAE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_a302eb89e87b53981114c6d09c943485_elex_mafia_stealc_tofsee.exe 4A7B564FB41F4BF03E7EDD4A43A7D9A07CFA6429E1C93FA158DF851025626EB3F90900B39A980ED23187028998330CCB8E4FABFDB09A5647B6C6B28A5175B10B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1900

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3AAE.tmp

Path C:\Users\Admin\AppData\Local\Temp\3AAE.tmp
Size 414KB
SHA256 c4d28791f52aafee1c5557f34b7f47c6ae79e7a0fca586f773c1006381e04e33
MD5 d0baacf7c43d5d8e86c8b13da260b562
SHA1 b47e865260cd4ec860b458a33ea5ce7cc0a2c425
SHA512 97762cb5474c90ac12266f2a001987cd342a51ed542f6c80b4f7c00ee958b001abb353d343531055150c6c15112d4ea1bb564f16e0e8b45efac2eabb9629848a
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6zms4JB3ulTNclBGDHPO3OuKvB1zfI3:Wq4w/ekieZgU6/4yTNc7GTejK51zfS
TLSH
T1F994E0203586C036E29706358BE1CB696A7A7D654B36A4C73BD42BBF6E342C1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download