7c6048d63266ac4cbf71533dd3781eb5b5c38db5b1eb40733a7ec711c48a04a1

Analysis

max time kernel
148s
max time network
132s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_229810534e11f100be6f5ca01fdc69b4_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260719-vr78vsas2v
SHA256 7c6048d63266ac4cbf71533dd3781eb5b5c38db5b1eb40733a7ec711c48a04a1
MD5 229810534e11f100be6f5ca01fdc69b4
SHA1 49df8e53e9c72ace5b456bddabd447a486a50f01
SHA512 24fca1e59597e46c2565fc04ef84e7ede61b407824de6c808a13489c7bfb3a397c2bab735fa6f8f4bcaa030fc9f6c1dabad73f2b69bac7852485c8ae3537c6fa
SSDEEP 12288:aO4rfItL8HRAbR6+DSUzQZmp0eo+u11YJtVks7K9wlsDpVFd:aO4rQtGRS6+DSx8Do+u11YOs+9wlsDpN
TLSH
T1C8A4F1257682C133D29202701BE6DB9AB73E79B0137694C33BD8026D1FA1AE1D77635B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2440	8207.tmp

Executes dropped EXE 1 IoCs

pid	Process
2440	8207.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_229810534e11f100be6f5ca01fdc69b4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8207.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 2440	3556	2026-07-19_229810534e11f100be6f5ca01fdc69b4_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-19_229810534e11f100be6f5ca01fdc69b4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_229810534e11f100be6f5ca01fdc69b4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\8207.tmp
  "C:\Users\Admin\AppData\Local\Temp\8207.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_229810534e11f100be6f5ca01fdc69b4_elex_mafia_stealc_tofsee.exe 60F84BB646B091E17E85EA1DA80ABB522A645933305D11B5E4CC118586F36D741ECCF12D2D62ED1BF3C0976CE552BDC3AF3E0BA3C09E442D03938C95819556FF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8207.tmp

Path C:\Users\Admin\AppData\Local\Temp\8207.tmp
Size 476KB
SHA256 dfe473064326745212a8a65855b3d2b13055283de126f1a487b46a9454ce4826
MD5 a6a2e34dacd0bde91de785d3b7fb49ed
SHA1 3c3205242e713ac5efdee6a4149a33a53fccfdf2
SHA512 a7485f3eeabd62e0bd0f3db57f8a66ebe8ba6765bc6c2307f11fed2be75d4cb04abacc29ca487ae0f5598e9dec80cfe76cc410c157311b608ece5f6a6680e39f
SSDEEP 12288:aO4rfItL8HRFO4l505Knx2uiYKuJAjphuOpRq7K9wlsDpVFd:aO4rQtGRFpsRJlsmckRq+9wlsDpVFd
TLSH
T19EA4F1397680C233D69302741BE6DB96BA3E74751725A4C33BD4022E1F62AE1D33A397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download