4b10842425998ab74f8e7c9a038464b1ec9d30e02273f16c75bcb786528da903

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_22ae0283bc599c0b724cbd09c3c1a811_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260719-vr7bkaas2t
SHA256 4b10842425998ab74f8e7c9a038464b1ec9d30e02273f16c75bcb786528da903
MD5 22ae0283bc599c0b724cbd09c3c1a811
SHA1 d9d71d8aee47274b6aa9f34e9c948edd133886ee
SHA512 74fd8f28d9fad2da7911e9aed661f29a82a6748b4704bbb61f4309e905a818da1fc247b1e72af8f1bcab11b710cead9bef22350e4a504d2cdc1fe5167f9e0c26
SSDEEP 12288:aO4rfItL8HRNDmq8HEQx/BmXynLu7K9wlsDpVFd:aO4rQtGRuhwXyLu+9wlsDpVFd
TLSH
T184A4F13A7681C233D19302355BEACBEA673E75700366A4C73BD4426E2F61AD0D77A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2712	8265.tmp

Executes dropped EXE 1 IoCs

pid	Process
2712	8265.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_22ae0283bc599c0b724cbd09c3c1a811_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8265.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 2712	764	2026-07-19_22ae0283bc599c0b724cbd09c3c1a811_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_22ae0283bc599c0b724cbd09c3c1a811_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_22ae0283bc599c0b724cbd09c3c1a811_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\8265.tmp
  "C:\Users\Admin\AppData\Local\Temp\8265.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_22ae0283bc599c0b724cbd09c3c1a811_elex_mafia_stealc_tofsee.exe 3E064147C3A4E878BC82EF360BB194DB25BE3B28F92D32B85AB78B0AAE90649DA00ABE95799422E3DF32793B9B6F672DFA39BF76E253592C9A9F9A56B2D627C0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8265.tmp

Path C:\Users\Admin\AppData\Local\Temp\8265.tmp
Size 476KB
SHA256 117ca4bfe7514cdfe35bbfdbb618133e6a237af611caaea81cad446250af3708
MD5 a1ba4605c48287b0a5e3a3e2dd34ab1d
SHA1 d704e63b37487eca09d0fe0fb7756a745947ae38
SHA512 027b404a424bf26331fd76fe8a49b34378e52056fb9bcafa367ac8924872d135c3f9f96411fae579de2309f15eb1bc648cf542e45d5e4dd2b7ec44c88c628dbb
SSDEEP 12288:aO4rfItL8HRZh+nzoRztRRTmXbrn65MdZU7K9wlsDpVFd:aO4rQtGRD+zSztRAPmME+9wlsDpVFd
TLSH
T127A4F12A36818133D29302750BE7D7DA663E78B55326A4C37BD0067D1F61AE1E73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download