8bffa5e42e043eee557f3c61234b5ef5cd56ca521ea6760c2b1d33b1893c3045

Analysis

max time kernel
148s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_e933910774fa930090d8c5c51ad44d4e_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260719-tx5jgset3r
SHA256 8bffa5e42e043eee557f3c61234b5ef5cd56ca521ea6760c2b1d33b1893c3045
MD5 e933910774fa930090d8c5c51ad44d4e
SHA1 6b6b0a61a8089f722a3c01f1bfd7675b31037a56
SHA512 203abdf4ee5590ce35ea8c858e51eae8f8de8cb191b6573121d8ace0f7713205e1127c4dc4e60420b4fea1b167f64d79558b47daeb58c6840d09d9dd50543f71
SSDEEP 12288:Ci4g+yU+0pAiv+aQu+SHFAGIquRP0DYbF10UL9mBWICn:Ci4gXn0pD+DSH2HRDX0+oBFC
TLSH
T16094E0303592C033E2A719344BF59BA66A7E35A6072674CB3BD41BBE6E603C2D635347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4064	3EB5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4064	3EB5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_e933910774fa930090d8c5c51ad44d4e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3EB5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3140 wrote to memory of 4064	3140	2026-07-19_e933910774fa930090d8c5c51ad44d4e_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_e933910774fa930090d8c5c51ad44d4e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_e933910774fa930090d8c5c51ad44d4e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3140
- C:\Users\Admin\AppData\Local\Temp\3EB5.tmp
  "C:\Users\Admin\AppData\Local\Temp\3EB5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_e933910774fa930090d8c5c51ad44d4e_elex_mafia_stealc_tofsee.exe 2DB61196BA927A62AE9B41D1D1BC4687797B5C676D4A05E6308AA900C09C7CE8AE8AB1135A0B560212AB344DE46BF84C8CFDA2FBB0B0FC5C7AE5039D7EF379F5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3EB5.tmp

Path C:\Users\Admin\AppData\Local\Temp\3EB5.tmp
Size 433KB
SHA256 69c44c735cd25f5bc9f8f72f409e34dc7c16ed4b819e053cdf6256ba696bb270
MD5 ade415aae0118f67287dc2f8512463aa
SHA1 3abd6eddeaa16c0f3fd1ba5fd8d703effb0dbc72
SHA512 7cba9a6eea49ddb4db35c622ca269f922d46bc8b2f77242690cd3789963e2f5c8d7239f4653cbf7876c882e602cd43f34d9624f5965beb881eecb738c4543391
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvqXzFy1n/YNfQqfokctgd5MgkFaEce9UQ8Nn:Ci4g+yU+0pAiv+oXZy1n/ocsyValeQNn
TLSH
T1EE94F1253542C033E69215314BF4DB66697E39B54722B4CB3BD40BAE6FA02D2EB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download