ff9fb4a1e9e2195afce0d0825da22d458ff1f5ce729e264d8739289b394a9727

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260720-nbp9saat21
SHA256 ff9fb4a1e9e2195afce0d0825da22d458ff1f5ce729e264d8739289b394a9727
MD5 ce31acd2003ff98927e1d0ab747f1b3e
SHA1 abb40528d0b639d4b39b06d20b0c069d9b5913f8
SHA512 ebd67b3e6838ecdcc29231b914aaa8e30e2e2968fc992a3a3fe009b02d49a85ae0c49bee1e2e3dd6bd1031c09aa0c79cb474d57bdbab3605982bf4b77452193d
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStLS41UzVjW/4ryqA/TC/Dmn2HSQ7xMRS+GSy:Nb4bZudi79LMnwHA/TC/1/7+RSSA0a
TLSH
T1BFA4E0203582C037D29716744AE6C7F5663A7CB15F62A8D73B943B6D2EB02E2DA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3224	3B59.tmp

Executes dropped EXE 1 IoCs

pid	Process
3224	3B59.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B59.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3556 wrote to memory of 3224	3556	2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3556
- C:\Users\Admin\AppData\Local\Temp\3B59.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B59.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_ce31acd2003ff98927e1d0ab747f1b3e_elex_mafia_stealc_tofsee.exe ABA155AF8077A3F17E2B67A8A639ED3872F74621F905519069F49D6459BEC8EB1C13E7877EB7CEE245FEE80F32CA653CBE2514E25E317BA00D956886F88CE204
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3B59.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B59.tmp
Size 473KB
SHA256 7dea668cf6054d3e0b5cbea10be0d0f0ea6b11f3359f986257036d1899a15a2d
MD5 56efb28200499e40b42b683ce6b8e2fe
SHA1 89ca0948b7511eb57c89da7531a9315e287d412b
SHA512 38906c1351d0dbba989d0b1fa133184a1b55a507c2f5b4c267bca31cf8fd284a4c6d6301a45e25bea2843923e8e47f8aa1aff12f751a82c95c46e632b4fe768d
SSDEEP 12288:Nb4bZudi79LSly1NjB15CygAmnEQfmJA0a:Nb4bcdkLSlyvjFHVkEQuQ
TLSH
T161A4E0243581C032E29712340BE6D7F56A7E3DA15F6268CB3B9037AD5EB02E1DA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download