b16ddadba2718a57bec79c5404c2f94337fd085572c5e0fb454af144b320e69b

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 00:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_d53eb2de07dabeaf5ca8abc32386a58c_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260720-avmfcacx3w
SHA256 b16ddadba2718a57bec79c5404c2f94337fd085572c5e0fb454af144b320e69b
MD5 d53eb2de07dabeaf5ca8abc32386a58c
SHA1 9dfbb202a9859046e246a2f65892db9d4b65eaaa
SHA512 f5d722307214486906f6c2c145a0f344a575e81ecc04a691207155492f4e83524c7941116977652026afa96d2f26bcc42f8c775274e6b6a4aaf60fd95b023ddc
SSDEEP 12288:Ci4g+yU+0pAiv+Z5zmqoik0iZwmtJHUPeRTcnJBZ+ln:Ci4gXn0pD+Z5zoR0EwIJ0PacJBs
TLSH
T18894F1207196C033E29715354BE5CBA6697E79E10726B8CB3BD01BBA6E643D2D73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5124	219.tmp

Executes dropped EXE 1 IoCs

pid	Process
5124	219.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_d53eb2de07dabeaf5ca8abc32386a58c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	219.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3184 wrote to memory of 5124	3184	2026-07-19_d53eb2de07dabeaf5ca8abc32386a58c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_d53eb2de07dabeaf5ca8abc32386a58c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_d53eb2de07dabeaf5ca8abc32386a58c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3184
- C:\Users\Admin\AppData\Local\Temp\219.tmp
  "C:\Users\Admin\AppData\Local\Temp\219.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_d53eb2de07dabeaf5ca8abc32386a58c_elex_mafia_stealc_tofsee.exe DE379AAA1B5D66CDB85B945DC6BB5600651EA0CA746488C5C230E3A81E8C19F6FBADAA7C3CFA1FB74C284440960A36C91C96D741988EE60CC545ACC162803B28
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

219.tmp

Path C:\Users\Admin\AppData\Local\Temp\219.tmp
Size 433KB
SHA256 157e0faeb73c22955a520c640951b448aa8d5968ac411d3e896faec3d31cbe09
MD5 6486c2df67938722df8670faaf98e6a3
SHA1 3dc3116c73f88fcf0c9038965c3bf74ce010fa49
SHA512 1e17f161ea0e7d45c4d9728b4be6c587ffdeee25256658facddba02d888b5d297ca7a808d11ac38d99e628e7038329087e09c5711eb491c68fae6d0c0b0f4ab0
SSDEEP 12288:Ci4g+yU+0pAiv+TCXYuTn/K7fzN4PsxU+Iin:Ci4gXn0pD+TGTnqr/ei
TLSH
T18994E1317196C033E5A705744BE6D76626BE39A20B2264CB3BD41B7E2EA03D2E734357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download