3b4bdf967d1726b00cea711f798e0255edf2dfb1f3b8cd91b85ebc68d3e88dd0

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_8146c7f98cc1a7f03ebcb14edf0b7ecc_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260720-bhpklsdw5v
SHA256 3b4bdf967d1726b00cea711f798e0255edf2dfb1f3b8cd91b85ebc68d3e88dd0
MD5 8146c7f98cc1a7f03ebcb14edf0b7ecc
SHA1 29bd8b273579037bdb797d481afabbc6499e1e6b
SHA512 e7607537b3ff026afcb2e2fa885be27018de5adccba1b5748239d886955b1b8f52ee045af57cdc35811c4bb036f92d8117d3ef10f0f321b3bcba42d175b56bcf
SSDEEP 12288:Ci4g+yU+0pAiv+hlNai1Nn0NirLSpxN9NV/2oc5nn:Ci4gXn0pD+h/au8QxzJ
TLSH
T1AA94F0243542C033E2A705354BE5D7665A7E7AA14B2268CB7BE41BBE2F643D1D33834B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3320	3B69.tmp

Executes dropped EXE 1 IoCs

pid	Process
3320	3B69.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_8146c7f98cc1a7f03ebcb14edf0b7ecc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B69.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1804 wrote to memory of 3320	1804	2026-07-19_8146c7f98cc1a7f03ebcb14edf0b7ecc_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_8146c7f98cc1a7f03ebcb14edf0b7ecc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_8146c7f98cc1a7f03ebcb14edf0b7ecc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1804
- C:\Users\Admin\AppData\Local\Temp\3B69.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B69.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_8146c7f98cc1a7f03ebcb14edf0b7ecc_elex_mafia_stealc_tofsee.exe 8E5BFB98EF9037576C054FEC08067DF09F96493ABA4EEF4EF42F8EF7E9ED97A9DDA79B3F8495FC3E4BDBDADC4AE62F03F95EB9B8A4F1024C29B3763E07A94A7C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3B69.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B69.tmp
Size 433KB
SHA256 754e1cd9c1a6e622d84589ce90a59ec2d95bedac1247017436b09131722d3b22
MD5 e47a4a133ba8af5e133f33faf563c328
SHA1 b133ae09655b3f6f672784448b448a8c1c80fd76
SHA512 971f411484e6a92f34a076f318aa2310ecee2d7ab8921356e71e84e55bda35de7ad315fbc465ba344dba6f36241271e845c3e8ddd5af744d049469bcb5de6fa7
SSDEEP 12288:Ci4g+yU+0pAiv+pH9c6CnT7C4hhahGF3pBn:Ci4gXn0pD+1fcT77hhEGf5
TLSH
T15894F2203592C033E29706384BF8DB66257E75A50726B8DB3BD01BBE6FA42D1D67434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download