792ba228d89cf3b50272ce82981d80ff4d1ec9649f1897affc1023a7a6cd4903

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260719-vbamnahw3s
SHA256 792ba228d89cf3b50272ce82981d80ff4d1ec9649f1897affc1023a7a6cd4903
MD5 927662b57eb736dd1e36ae30a4b98436
SHA1 a1d0400169f5aeca77c72e041a0810a16a440d67
SHA512 9c52e9fc2a121250c9d6d04e3525678589ac976d8cc17dc204c3d6a2f07444e0839f2c3d82d72206597592580beb5de7823c308af72f1594204aeeff85838749
SSDEEP 12288:qO4rfItL8HGAUMh04P8Vcm5HpvRhOqMo7bWmeEVGL:qO4rQtGGAUMG4P8VnHDYqMoumeEVGL
TLSH
T177A4F1267281C133D69312714BD6E796BA3E79740722A4C33BE8027E1F666E1D37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4308	BF82.tmp

Executes dropped EXE 1 IoCs

pid	Process
4308	BF82.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BF82.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4580 wrote to memory of 4308	4580	2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4580
- C:\Users\Admin\AppData\Local\Temp\BF82.tmp
  "C:\Users\Admin\AppData\Local\Temp\BF82.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_927662b57eb736dd1e36ae30a4b98436_elex_mafia_stealc_tofsee.exe F8DB58087DD1FA17BB0C16D294D5C916E1C818988E6DBFB280E219EA6D26D6F53C4D52CEC1998A57E32F8A0CE9A4E30BE2FB3236D268D06124C141E50F089A45
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BF82.tmp

Path C:\Users\Admin\AppData\Local\Temp\BF82.tmp
Size 468KB
SHA256 64a810813635519724c641d6436a5f9854f833a9f4cb8dcb644e3916eb39b6ca
MD5 cbd95d4b1d0f9a80712a2c3b221c5960
SHA1 f0f20a025cf8a51239333c30b4c5aa75dd129882
SHA512 184d6af527542f5a5022c7014c9050026aecae786b352a14c6a1db5b89b9813e83a70a2655eb63696f49f7c62a98c5358e4f32221504ee4fb0a4e3b5a63805a1
SSDEEP 12288:qO4rfItL8HGyFLm91k1zT2l0s+NZhpPtVQUPJ7bWmeEVGL:qO4rQtGGyJm08B+Hhp0UPJumeEVGL
TLSH
T18CA4E13AB681C133D29302751FE6DB6A6A3E75B4032690D33BD4027E1E65AE1D37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download