65f679067470efac4e7f771d9d5d95427399e0750597569575479b6b68f27a76

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_d9c7792100e3824aa0c21e5a7f6301a1_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260719-t1c9eaev2k
SHA256 65f679067470efac4e7f771d9d5d95427399e0750597569575479b6b68f27a76
MD5 d9c7792100e3824aa0c21e5a7f6301a1
SHA1 93c54b5aa0ef04e2efee8a85ee29e8dd5b705fd2
SHA512 e1a61281b40df1c51424183e900911e93b12a9f4cb2472134361b751edd87eb5a5257e84ae2912004ac7bc890089931115aa0e1078896da5cc363ff8a1938be6
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStHGaBBKFpX0DSZj2CycvaqfRpyJAHn0pENdT:Nb4bZudi79LCN0DX0CjZpaKnl5ngxA0a
TLSH
T132A4E0243581C037E2A712340AF5CBA5563A7CA15F7268DB3BD47BAE6EB02E1D630357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2580	F930.tmp

Executes dropped EXE 1 IoCs

pid	Process
2580	F930.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_d9c7792100e3824aa0c21e5a7f6301a1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F930.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1180 wrote to memory of 2580	1180	2026-07-19_d9c7792100e3824aa0c21e5a7f6301a1_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_d9c7792100e3824aa0c21e5a7f6301a1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_d9c7792100e3824aa0c21e5a7f6301a1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1180
- C:\Users\Admin\AppData\Local\Temp\F930.tmp
  "C:\Users\Admin\AppData\Local\Temp\F930.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_d9c7792100e3824aa0c21e5a7f6301a1_elex_mafia_stealc_tofsee.exe 4BEC98D5BAA1D1C4812953017DE78CA95BFF702302A1989654C9EB0A86E5D21D5A319424B00B05A351643CFD4745E8254ECB788B83BDC132A7BAE2BDDF8F3B72
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F930.tmp

Path C:\Users\Admin\AppData\Local\Temp\F930.tmp
Size 473KB
SHA256 88a7539ef16baba7fb874c8ebb99496120ee317f746c2886ccc9b7f860759da4
MD5 9746a1a9cf65a7bc898f3b3ddd3993e9
SHA1 5021911d048e59fa8dd81fa383786913d842f3c6
SHA512 3228a4d0a847eabe0f2c44b027002b7745f53417b4adaa3c2ed886456b58fb2a76819aac896f988926d6695c5291499e92413ade544cc73a55166c38de5a6cf5
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStl6PEjcJWyDU5sl4ztBse8sgtXh8iXWDZe1S:Nb4bZudi79LBPAr5Jssa8imNe1A0a
TLSH
T1DFA4DF243181C036E2AB02350AE6C7B5657D7DA19F3268C73BD4776E2EB12E1DA3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download