c9ca6bd44743eacb316d15350993f47907e2dcba08c88232ad91c119c8ce82e6

Analysis

max time kernel
150s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 01:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_51a396af718ed78a8d7f2a9ab71d638d_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260719-ccdftscs9s
SHA256 c9ca6bd44743eacb316d15350993f47907e2dcba08c88232ad91c119c8ce82e6
MD5 51a396af718ed78a8d7f2a9ab71d638d
SHA1 4611accbcb9b8817fa1c7ee8ecafd144576426c2
SHA512 d36818f9e40bc39796abae3973779938c76a6b7dbd0aa4b0cbb8a9ea89d3151857e50453741bcafe007d2e7361b16f3c944d2f4419db249daf4810dd3b3f30ce
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYvl/x+rD9KuhdKLM+gbpHw7YkPhjutWHZmmKwwP:fd4x+ePixnXQji5UxQtgbpHautgXpwP
TLSH
T12494E0203586C037E1A705384BE5DBAA593A7D704B36A8C77BC42BAE5E742D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6116	429D.tmp

Executes dropped EXE 1 IoCs

pid	Process
6116	429D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_51a396af718ed78a8d7f2a9ab71d638d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	429D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6856 wrote to memory of 6116	6856	2026-07-19_51a396af718ed78a8d7f2a9ab71d638d_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-19_51a396af718ed78a8d7f2a9ab71d638d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_51a396af718ed78a8d7f2a9ab71d638d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6856
- C:\Users\Admin\AppData\Local\Temp\429D.tmp
  "C:\Users\Admin\AppData\Local\Temp\429D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_51a396af718ed78a8d7f2a9ab71d638d_elex_mafia_stealc_tofsee.exe A0529CF22C001D9EF97D3A822747145BA12821D4F0EE2142AD47E723A755EA952118BFC6CBC75A1A8569BF3186B1515E22470385F100FFE08D5D3DE47018CB2B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6116

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

429D.tmp

Path C:\Users\Admin\AppData\Local\Temp\429D.tmp
Size 435KB
SHA256 7d8ec3b6b6234ccc56f2f3ddc95ba0b3fdd987e6566f5fdd752046e3a9cf023e
MD5 dc2b104a9fc97f7ae0bbe7f361df4ec5
SHA1 8f6e6c3a08e78ae91188d32255b7562a2e12c686
SHA512 5378ace5c0a760879a1ab5a2fde5b2532efeb98aa481d9a9560021bb52c20b983a1e51c359ad8939af90496f11dddd1342e77c434618cae34cf2a5bdef04ff1a
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYzXDa8qAxKjU48ZpGr0FwduDzw9J:fd4x+ePixnXQjQxKA3y0FwdazwP
TLSH
T10A94D0213186C03BE1A705344BE5CA6A593E7DA50B36A4C73BD42BAE6F742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download