0bdc3c3abc501a2141143b5d52491fcd249fb412845300c01cc4ab4f511b3d8b

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_d19b3660708e251e78add963647c95f1_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260720-p1slwacy2s
SHA256 0bdc3c3abc501a2141143b5d52491fcd249fb412845300c01cc4ab4f511b3d8b
MD5 d19b3660708e251e78add963647c95f1
SHA1 351e5aa696fd7b559e69c6eec01ad436d5308baf
SHA512 d8e66926e4dea5152e95551d6201f196a7fb59c3c9fe2c1a85482376860f1b0c342bbd2f9aaaf6ef0b37d605726b513ebaa0bfcab2c3db2bd4d3230275c6260c
SSDEEP 12288:bO4rfItL8HAxpvnKwOFVxEBjModHyEynzHbqPy75UO:bO4rQtGAxpZkxsrdHcDEyVUO
TLSH
T1DCA4F12A76818133C2C302751BDAD7AAA63E79741726A4C32BD4037D1F617E1D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3092	BFA2.tmp

Executes dropped EXE 1 IoCs

pid	Process
3092	BFA2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_d19b3660708e251e78add963647c95f1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BFA2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3092	3632	2026-07-20_d19b3660708e251e78add963647c95f1_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_d19b3660708e251e78add963647c95f1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_d19b3660708e251e78add963647c95f1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\BFA2.tmp
  "C:\Users\Admin\AppData\Local\Temp\BFA2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_d19b3660708e251e78add963647c95f1_elex_mafia_stealc_tofsee.exe E02409380AB356E461E99775D2F26657491AB34B5468AEE4857A01E010BD783389B0E70063C88C0E224010B706F82F5030B0B4ED02739CC68686921A97423122
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BFA2.tmp

Path C:\Users\Admin\AppData\Local\Temp\BFA2.tmp
Size 479KB
SHA256 54909da5bc8c8e519641fba6eab9858b9422cee0361d2cd8c526a8c82f6b10dc
MD5 1799fa305739afbd071470233584ff70
SHA1 fe82c6e9fe9a10b837c5919e3f135bdd49c6b478
SHA512 df9846a464218e7f261188b9ed410de7a2f34305a571c502992e716111764a078592211ca2de75c2e421c9e224f5742cfc0db1ff5426d99cbee55195a847d0d4
SSDEEP 12288:bO4rfItL8HAg2hhH27oRvgN4CdvQhdicU3xF75UO:bO4rQtGArhNQoRjCpQH+3LVUO
TLSH
T1D5A4F12A7781C033E39301350BE6EBA6BA3E39B50726A4C76BD4026D2F556E1D736347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download