9539e8d9e259208cd5dab8c66aeabfff9042e7af1b219ae2c2ed65a226b581f3

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_bfca6a1a5f963cbfe6005687e070b4fc_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260720-p28pgsax6k
SHA256 9539e8d9e259208cd5dab8c66aeabfff9042e7af1b219ae2c2ed65a226b581f3
MD5 bfca6a1a5f963cbfe6005687e070b4fc
SHA1 6e201199a6163f540786c825034cc05ca0e1f423
SHA512 c305d009a9cdd15c49d939a741804c576a830691ffc6a2a7f433aee9051f601a83513eb85519f41de61f96ae7c1ec052971e51eb5893f3a99e703ed3758640d2
SSDEEP 12288:qO4rfItL8HGAMCC3uYt+HPlv5SdXGQggnoKA6IzZ7bWmeEVGL:qO4rQtGG1CYuY4vlv5PEPcumeEVGL
TLSH
T1BBA4F1267641C133D28312750BDADBAA6A3E75B40726A8C337D402BD6F617E1D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2132	FDB4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2132	FDB4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_bfca6a1a5f963cbfe6005687e070b4fc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FDB4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1052 wrote to memory of 2132	1052	2026-07-20_bfca6a1a5f963cbfe6005687e070b4fc_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_bfca6a1a5f963cbfe6005687e070b4fc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_bfca6a1a5f963cbfe6005687e070b4fc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1052
- C:\Users\Admin\AppData\Local\Temp\FDB4.tmp
  "C:\Users\Admin\AppData\Local\Temp\FDB4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_bfca6a1a5f963cbfe6005687e070b4fc_elex_mafia_stealc_tofsee.exe A7409D34D868F6C9DC9419C95A5C835ED0FF6439E4625E60E71ADD3965FB9661D52C5404CB5805D9E4EA29A3DD9D13FEDDB21D87F00D2D29A134A7A743C1E12A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2132

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FDB4.tmp

Path C:\Users\Admin\AppData\Local\Temp\FDB4.tmp
Size 468KB
SHA256 09518bb2fb494918c83516d7a5a595f6cb995b64baa9efaedb684d4f7ab1476e
MD5 c136944bbbc712df73efefe77bed641b
SHA1 3d1db7ccdc6507ae922ef80898013719d9d16bcf
SHA512 0acfa5bd6423c7d9461d41e9251b7ed640bd4e1ed408124080282cee981b6bc1fb02be16680a7cc3906b682127e04a62cf3c3b5644f65fa837186de2b88f3646
SSDEEP 12288:qO4rfItL8HGMZRbyNp6HkFow9ZvNHHcyaYw17WNV6A7bWmeEVGL:qO4rQtGGMMpfhbhcyaYw1aKAumeEVGL
TLSH
T188A4F12AB241C233D29301765BE6E7AAA73E74B4432194C33BD4467D1FA56E2D33934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download