91d6458986735700ae6e6b8a2fc9db8c318cd87b597c2317e454232fe5a86943

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 16:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_775ef6eef19ad72a83851a394a41e07e_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260719-vfcb2se18j
SHA256 91d6458986735700ae6e6b8a2fc9db8c318cd87b597c2317e454232fe5a86943
MD5 775ef6eef19ad72a83851a394a41e07e
SHA1 af385caa84945125f19e1f79ed59549c68af7679
SHA512 b325f891bbec36ae8358131c9d7ff9c07f1334cd584df1ffab7e301b8c9a5cc11a9dc32ac7964957ba00fb405a3a095086fe28b12a3563f49928cee192b1e689
SSDEEP 12288:aO4rfItL8HRcGx8C262a8Z0M21+D6UhHHv7K9wlsDpVFd:aO4rQtGRck8C2e8x23UV+9wlsDpVFd
TLSH
T191A4F135B681C233D29301744BD6DBA6BA3E79751336A4C33BE4022D1E65AE1C77A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3088	811D.tmp

Executes dropped EXE 1 IoCs

pid	Process
3088	811D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	811D.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_775ef6eef19ad72a83851a394a41e07e_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 3088	3600	2026-07-19_775ef6eef19ad72a83851a394a41e07e_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_775ef6eef19ad72a83851a394a41e07e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_775ef6eef19ad72a83851a394a41e07e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\811D.tmp
  "C:\Users\Admin\AppData\Local\Temp\811D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_775ef6eef19ad72a83851a394a41e07e_elex_mafia_stealc_tofsee.exe BD917A3629B7666E885DB232AACA71444B7F7AD5D93EA45CBE42A3A783925409582A785AC9CC991BFD8150B7D61EEFB42DFBFB6C5E1EA48002CB7B11E51C2394
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

811D.tmp

Path C:\Users\Admin\AppData\Local\Temp\811D.tmp
Size 476KB
SHA256 229ecd2c33584ef6fe65e7c93aeb780e1a2b49f7119f1c1ae3618a1e1a73f7c9
MD5 70e664fc664d5d5e84d5392b62a4bb4f
SHA1 f31a29d907f2296b187bfd280d8e4dbbe6211763
SHA512 7fb8d94a434af57805555e9483077a18ce1c3ee9e82c3541b63a20ebbf3f3ccc374f53d3ca4c2b7f68902f5e83b2cb6e72722c7ef1beea2b4dc923832f1cc80f
SSDEEP 12288:aO4rfItL8HRSDSQRiJDpzDPIoO4TsdKmot7K9wlsDpVFd:aO4rQtGRSDSQRixpvs4AKH+9wlsDpVFd
TLSH
T13EA4F1297281C233D29301714BDADBDAA63E75B5532694C337D4027E2FA16E2D37A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download