813749359fa2edb22467b661cb2913c2d7ee73bb30b67e11994ff35d4c0a103a

Analysis

max time kernel
150s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 06:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_f4e4329c64ed3a18a539aa300009925a_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260719-g3rtcsgs4s
SHA256 813749359fa2edb22467b661cb2913c2d7ee73bb30b67e11994ff35d4c0a103a
MD5 f4e4329c64ed3a18a539aa300009925a
SHA1 014294cdebad069cb686cc1aa6650c5864fb2446
SHA512 08d795b9b7e0cd75fa5335ef588c7ac3aa9903ae1d06c388a44562f92c834dd032f4713fab1e70e42fd4fbec547f9b4dc3056e66b3eed1c492c84926c52926ca
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStiWBdFLD2Baeyk+jlfp0pJqguAWWfacde6pp:Nb4bZudi79LILohyk+BAWwS6BiA0a
TLSH
T1A5A4E0243581C036E29716390AE6D7B6963E7CA15F3168C73BD43BAD2EB02E1D634397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5676	36E5.tmp

Executes dropped EXE 1 IoCs

pid	Process
5676	36E5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_f4e4329c64ed3a18a539aa300009925a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36E5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 5676	5168	2026-07-19_f4e4329c64ed3a18a539aa300009925a_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_f4e4329c64ed3a18a539aa300009925a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_f4e4329c64ed3a18a539aa300009925a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Users\Admin\AppData\Local\Temp\36E5.tmp
  "C:\Users\Admin\AppData\Local\Temp\36E5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_f4e4329c64ed3a18a539aa300009925a_elex_mafia_stealc_tofsee.exe 58764140A8DF682E71FBA3E166D7275241617E65EDDCFD5E39216FB94032B69318E038D37B69541181AA460A8DFEE3D72EA60DFF9CD8FEEBC4D1D0387F6541E9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5676

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

36E5.tmp

Path C:\Users\Admin\AppData\Local\Temp\36E5.tmp
Size 473KB
SHA256 e8099645d22efaf6f49141119677a5227a19a906452318baeec2ecdbac208629
MD5 77a4f15bd31e7776234a08e81d6b621c
SHA1 d06b4dfc56d1f8561bfa34a3cde922480a8ca7f9
SHA512 0de21a8022ea3f7f58e967e08359cd45b9aabad5679dfe7d7f52e4d169f0196ba18ee9dbbf18b4f890301bce412037d1c5bc53cdcdef880ebaa126632f7c3424
SSDEEP 12288:Nb4bZudi79LrEPTPVbA62gctOKSUzlGwFB7WA0a:Nb4bcdkL47Pc8KHRGwzh
TLSH
T17AA4E0243181C033E29712394AE6C7B6567E7DA15F2264CB3BD437AE6EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download