94caa938c00395c2998a7d87bc560b504dffda3105848b3f0b83f2a6d31e6eb2

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_ee643419b257131fe63dfdad2125ca4a_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260719-tw1txag121
SHA256 94caa938c00395c2998a7d87bc560b504dffda3105848b3f0b83f2a6d31e6eb2
MD5 ee643419b257131fe63dfdad2125ca4a
SHA1 2c19e7d0b65565f69718fbf34c6640b4e85cdab8
SHA512 a0c774ac228320f9b1ccd1a74013e5b6ae1d5ad02b9d39ed2ef8f838981d0972f1042c98030cc63f2529864a12dd79a176827107e3683e59d519789c5097c9be
SSDEEP 12288:Nb4bZudi79LhNZ2lf3F9WfqJ5AQgzU2jn+ajtvA7cDA0a:Nb4bcdkLhNglN9mqJ5I+88Z
TLSH
T1D4A4E1243182C037E2A716380BEAC7A5563E7C618F2558D73BD47BAD6EB06E1DA35307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1188	267.tmp

Executes dropped EXE 1 IoCs

pid	Process
1188	267.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_ee643419b257131fe63dfdad2125ca4a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	267.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4140 wrote to memory of 1188	4140	2026-07-19_ee643419b257131fe63dfdad2125ca4a_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_ee643419b257131fe63dfdad2125ca4a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_ee643419b257131fe63dfdad2125ca4a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4140
- C:\Users\Admin\AppData\Local\Temp\267.tmp
  "C:\Users\Admin\AppData\Local\Temp\267.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_ee643419b257131fe63dfdad2125ca4a_elex_mafia_stealc_tofsee.exe D8F65BA96135C8DD29E65633D98E253FBACF0095011EACA0CC27039CCD4883944A4BE384612F4F5ACF6FB7088BE546066E99354B93A391065B14DD390BBEB5CF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

267.tmp

Path C:\Users\Admin\AppData\Local\Temp\267.tmp
Size 473KB
SHA256 b2f2dcad1f34c3a008a87f4784b5d93ab3b3e6e0cbd3f572cd17b1533972285c
MD5 57d5987237b6f7a0a8ef84d34b858bd7
SHA1 f051c479b9e87e85d884edfbe5a2fca4abef1ac5
SHA512 ab22147138937f586420310d8974b04ae6de41613a1a330356fe86dbf6e1a3ea775e60fcd84e84b4c5f05677b682a2bc8387a2d7058e5d2fd7dd4f6a4756708a
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStsGeI976DrZtWiAkbAHS5pVHDXSKc6knSV5V:Nb4bZudi79LTB0OfWblS5D26SSXWA0a
TLSH
T14DA4E0243182C037E29716354AE5CBB5A57E7DA05F61A4C73BD03BAE6EB02E1DA30357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download