0a21c3d0878de2d1224869c2530a11ed242ddcd6c3afed93fd0fcd5dde8601e0

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 11:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260720-nw7dssbs2x
SHA256 0a21c3d0878de2d1224869c2530a11ed242ddcd6c3afed93fd0fcd5dde8601e0
MD5 5f394dc08999af189c4f016dcafa0265
SHA1 3c858aa32d3d8c632bfc563d6b802fef70b6b708
SHA512 ddb03e343ccb49c8e5675aceca86500bfbbedf569884d8d655046d6c5d31526b74b8eb710ddee6530171951dcc60eef863a31ac2fc08ea82ae756cd4b8cff896
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStOaGWvRtltU16cJeLabbXHfrrqlmEA+a6KAT:Nb4bZudi79LZYbosueLi7DrhEA+yA
TLSH
T1E0A4E0203181C037D2A315394BF6CB76A63E39A14B6568C73BC46BAD6EB43D2E635347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4320	4934.tmp

Executes dropped EXE 1 IoCs

pid	Process
4320	4934.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4934.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 4320	3800	2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Local\Temp\4934.tmp
  "C:\Users\Admin\AppData\Local\Temp\4934.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_5f394dc08999af189c4f016dcafa0265_elex_mafia_stealc_tofsee.exe AC6700DA9FB330CC6D470201D99576BDC606016557F2F49AF8AFB079B043FA52B5A454329E79D2AD5F16C9C2319DAE8B607E342A09A8BE06FDC336D03D324E6A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4934.tmp

Path C:\Users\Admin\AppData\Local\Temp\4934.tmp
Size 444KB
SHA256 84183c3f304ad3d9948202b2ba8ede54b9cd6a330dbd4e39241394f7a9d5c702
MD5 f3645eccaa8e3b07f0c7c856494ca61c
SHA1 bc271241088df7a009094006e27b9705dbbfaad8
SHA512 d531502f8acd62d821c7a3b3d61dbf20637da8a3e8f347f5c642c5225f066f1c76bda99810433b1be2b4b00887b2c0d7d5b295c4903e7bd4688b84139a8d4f39
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStFMZQ3EGtde4pbpQTV37hchMHB4nG9kSA:Nb4bZudi79LAH16cMHqwA
TLSH
T116A4E0243181C037E26716384BE1C7766A7E79A14B2668C73BD45BBE0EB03E2E635357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download