ff924b451ed12662388e99056493b42900de6890ed1712188d1a871d749ad8f5

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 08:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_c47af3bcac08b66671671eb7a1c771b3_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260720-krt15ab16m
SHA256 ff924b451ed12662388e99056493b42900de6890ed1712188d1a871d749ad8f5
MD5 c47af3bcac08b66671671eb7a1c771b3
SHA1 06667c296922d2799cd8649e854ab6dfb2b630d9
SHA512 8cc441646268e2258e349b8405e19065695fafff05a577078ef04813f5809c146a6d8b6e69454ceeb3290dc2dd4b80d8d0eb1ed02994f6371c5f561323c7c51f
SSDEEP 12288:Nb4bZudi79L95vVFBZ3Sf8gIwoeyjS3625eDA0a:Nb4bcdkL7VDvgI15u62/
TLSH
T186A4E0243181C037E29706340AE5C7B6653A7DA15F62A8D73B947BAD6EB02E1DB3035B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4708	DA8C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4708	DA8C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_c47af3bcac08b66671671eb7a1c771b3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DA8C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1240 wrote to memory of 4708	1240	2026-07-20_c47af3bcac08b66671671eb7a1c771b3_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_c47af3bcac08b66671671eb7a1c771b3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_c47af3bcac08b66671671eb7a1c771b3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1240
- C:\Users\Admin\AppData\Local\Temp\DA8C.tmp
  "C:\Users\Admin\AppData\Local\Temp\DA8C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_c47af3bcac08b66671671eb7a1c771b3_elex_mafia_stealc_tofsee.exe DD3431DDD993258B0EAE55B8717812B4A79B3D74AF5B5EB29869B1DB686779B5B41EE749C77A46B84BB3BF8C99047574DE31EF4A9C44A05AEEC0D2E43B51F26E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DA8C.tmp

Path C:\Users\Admin\AppData\Local\Temp\DA8C.tmp
Size 473KB
SHA256 2600e0a2238e810a71246cb1141b1302985a3faa0bc5ceb1c21d75e22d7c2bb4
MD5 26cb5bc8674aeddfcb3581ec1b888c35
SHA1 352b03a4255db86b21b69505136912b342abb7c3
SHA512 756a9ca3a0054200fea7a5fe43b465f69034256d3e19133f94abcc00782329f090620e4aaff71f006f605f31b3e1c679bcf731255fedc5920c5f5a207ac49832
SSDEEP 12288:Nb4bZudi79LM1Bdgkg0bqUR4MUbzuSTCgYyzyA0a:Nb4bcdkLGg9EHU/THn1
TLSH
T144A4E0253581C037E2A702350AE6D7B5553E7DA19F6268C73BE437AD2EB02E2DA35307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download