83f93e22aec292ffe7f829f12619fcbdd42734e97dcc0488ccda4b9ff7f308e2

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260719-ty5wmsg19t
SHA256 83f93e22aec292ffe7f829f12619fcbdd42734e97dcc0488ccda4b9ff7f308e2
MD5 e25134a0f7332c06288a392f33a0dec4
SHA1 3bad44952461e099ca3f4c937b399cd57b922b92
SHA512 5ae10a98a489760d169ce92d3d87f499318b1b0a911e29ee6ff99d8fb33b36da74a27add522f33d8e10f96f30c7cee7105a1fa42a2e887b79381bfb697f1906f
SSDEEP 12288:qO4rfItL8HG3NEr7m0kdVvI6jQ7bWmeEVGL:qO4rQtGG3arK0aVtQumeEVGL
TLSH
T13FA4F12A7282C133D19302710BEADBA6663E7875473694C73BD4467E1F25AE1D33934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3532	56B1.tmp

Executes dropped EXE 1 IoCs

pid	Process
3532	56B1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	56B1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 3532	2324	2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\56B1.tmp
  "C:\Users\Admin\AppData\Local\Temp\56B1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_e25134a0f7332c06288a392f33a0dec4_elex_mafia_stealc_tofsee.exe 420776A22FB9124FB13E545DA9848D369AE001D534D8433E80265F4399215258E07D495DF23B650830AF3491EBCC1E1FB4ECC93AA80ECDAE3B6F10B74B078EB3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3532

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

56B1.tmp

Path C:\Users\Admin\AppData\Local\Temp\56B1.tmp
Size 468KB
SHA256 5bb282188674a8d3baebede41a398260fd16c52f58ef93de15124f5f968e6757
MD5 c30e9d9b32f13bf416483b2992995da9
SHA1 1834043ceb8bf75d17228483bcc475cc08f52351
SHA512 c27e0c94bf72dc02267405a6a92ffca5a6b7cb0370bf607ee58ee9bb24d4eaf8835f995ac378cc5b4bd8637d7174ab8c5b0c16ad27f9cf35f29f96bc0b6f9a90
SSDEEP 12288:qO4rfItL8HG0Wo8UDPjCQwJMJTD0w6eOzQ17bWmeEVGL:qO4rQtGG0Wo8KPjCOkw6hWumeEVGL
TLSH
T1ACA4F1367281C133D19202755FE6DBAAB63E79B14326A4C737D8027E1F606E1D37A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download