9162647881bf89a2e44e8320d757e392d972a3a65e7540d4c3da5b443ba832bf

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 01:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_77afe5800899843380e7d959a82bcf94_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260720-blngqaa18k
SHA256 9162647881bf89a2e44e8320d757e392d972a3a65e7540d4c3da5b443ba832bf
MD5 77afe5800899843380e7d959a82bcf94
SHA1 6d375a8d4474fd9cbdb9d4e132df281d04e53103
SHA512 c4976f0c7b8ecd1653be157f17149c7cb4ce60416a5486e97fb448ae5ab58fdd7cbaed0e8c1954f09abd7d545ee47b3fa762a671dfc952adfe0731f83ab2af62
SSDEEP 12288:Ci4g+yU+0pAiv+kLLXtIc3UeIWPWAclMP3j2EpMFD4n:Ci4gXn0pD+kL7tI2P8jRI
TLSH
T17C94F1303592C037D65606354BE9C7A666BE79B60B26A8CB3BD00BBD6E643D1E374307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5872	DF1B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5872	DF1B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_77afe5800899843380e7d959a82bcf94_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DF1B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4584 wrote to memory of 5872	4584	2026-07-19_77afe5800899843380e7d959a82bcf94_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-19_77afe5800899843380e7d959a82bcf94_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_77afe5800899843380e7d959a82bcf94_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4584
- C:\Users\Admin\AppData\Local\Temp\DF1B.tmp
  "C:\Users\Admin\AppData\Local\Temp\DF1B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_77afe5800899843380e7d959a82bcf94_elex_mafia_stealc_tofsee.exe 3957075E43612AE8151186C5E63A16D9578F715F4F9FF8CF470F148885F5AB050CC7F78BD8D83B3B221338C9F3185C402C35BECF9644017524646384D38294AA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5872

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DF1B.tmp

Path C:\Users\Admin\AppData\Local\Temp\DF1B.tmp
Size 433KB
SHA256 b4ce7baafd91000fe062f096f46e75b716586f621a0f259b448d15a0cd5295cd
MD5 4607f3e0ff7fe4fbf9aba55c20b7342c
SHA1 6d5d7eb0a46583903b5a2e3185409623f240994a
SHA512 39c14466ac7b2d3c0250949f33b71ddaf9888fa74715c8e818dc958525e82dcc9a186eaeec354aa9f221c691dcd8b9fd09acdb475cfef4069660dab74b384732
SSDEEP 12288:Ci4g+yU+0pAiv+jgbY8GmoFBbQMzOunx0Xn:Ci4gXn0pD+jMY8/6bQyOuxO
TLSH
T12594F0203582C03BE29719350BF1C76A267E79A54726A8CB3BD41B6E2F643D2D738357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download