404a2108d88b215b86ff0b174ca5d308ed36f2cc6c9d2a55a3dcfe5bd3331a53

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 17:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_179a409b88d5d107a3ff3037b9180250_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260719-vtp53aas5y
SHA256 404a2108d88b215b86ff0b174ca5d308ed36f2cc6c9d2a55a3dcfe5bd3331a53
MD5 179a409b88d5d107a3ff3037b9180250
SHA1 393e70af951dbdd9afaa8698cb617b32d2fefd37
SHA512 0a3b2825a7d567bba5c877134b9a469d147fb34d1ee6bd8e49cc3041bd9d8d23579b234d2aa9b010b35f4ea899f67ecedaf4578271aeb25139f5ec429825a3f6
SSDEEP 12288:Nb4bZudi79LLofLkd7oDa277htE5cQIaiMA0a:Nb4bcdkL0fLkd7Knxu/nA
TLSH
T1F8A4E0243581C033E2A706380AE6C7F5A67A7DA15F2168C73BD4776E6EB02E1DA31357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3348	2B5C.tmp

Executes dropped EXE 1 IoCs

pid	Process
3348	2B5C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_179a409b88d5d107a3ff3037b9180250_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2B5C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 3348	1048	2026-07-19_179a409b88d5d107a3ff3037b9180250_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_179a409b88d5d107a3ff3037b9180250_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_179a409b88d5d107a3ff3037b9180250_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Users\Admin\AppData\Local\Temp\2B5C.tmp
  "C:\Users\Admin\AppData\Local\Temp\2B5C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_179a409b88d5d107a3ff3037b9180250_elex_mafia_stealc_tofsee.exe 61F8F71611A44B4BD63739DBD0A382E38666B93925B6BDDD6DB2DB3ABC687DB00E0D144BB702A3939BBC788B63BE2FE46AB315BD8826462D69C1DF2FADD39C7A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2B5C.tmp

Path C:\Users\Admin\AppData\Local\Temp\2B5C.tmp
Size 473KB
SHA256 dad094786724e020fe46dc6e7654cf873c38cadf69428f5302aecbc5a8d08e00
MD5 9a37d7d595dba71ab4c04290a5ff4ccf
SHA1 fff76bf1a38ff5f3a8d200e68cab0d2018318705
SHA512 00f9485402bf2922ae15eac944dc3f30266d2483afb1c5591878e7c4dea84fd80468184229a93478c449d251ed270ce49917896a20c29a8f4b3fb8e2eb908d35
SSDEEP 12288:Nb4bZudi79Lfc/+vtULY4gJZr3h3iagA0a:Nb4bcdkLkiULY4g0q
TLSH
T177A4E0243182C033E1A705354BE6C7B5663A7DA15F2264C73BD477AD6DB06E2EA3431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download