f5408d8201ae79c5ca6e7bcbf9c5083c158a63c4543f23d5657a228deb8e22ed

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b0ca83e24d1074e2057cc2542d5e6d10_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260720-p4vkmsay2k
SHA256 f5408d8201ae79c5ca6e7bcbf9c5083c158a63c4543f23d5657a228deb8e22ed
MD5 b0ca83e24d1074e2057cc2542d5e6d10
SHA1 aadac11f58fa25dcacd34457f77e9ff501a9b0d8
SHA512 6068e9488644f0b1aa87aa171c5016f519502afe5c38f4101a7628b8916281566c644caf9436465aeca8aa4da384ced271ca3fb4cf153e1a73ef9a319601555e
SSDEEP 12288:3O4rfItL8HP08q3s5M1vtRr9h0hpkdTHD7rKxUYXhW:3O4rQtGPbMtRrYcd33KxUYXhW
TLSH
T18BB4F12A77858133E2C201751BDBDBA6A63E75B10336E4C33798426D0F65AE1E736387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4820	A493.tmp

Executes dropped EXE 1 IoCs

pid	Process
4820	A493.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b0ca83e24d1074e2057cc2542d5e6d10_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	A493.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4932 wrote to memory of 4820	4932	2026-07-20_b0ca83e24d1074e2057cc2542d5e6d10_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0ca83e24d1074e2057cc2542d5e6d10_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0ca83e24d1074e2057cc2542d5e6d10_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4932
- C:\Users\Admin\AppData\Local\Temp\A493.tmp
  "C:\Users\Admin\AppData\Local\Temp\A493.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_b0ca83e24d1074e2057cc2542d5e6d10_elex_mafia_stealc_tofsee.exe 5B55D2DFBDF10DFE353BE96B3FF75F651E587A2D2EB7A7939163A6A2697432DA5DF5A8D05B883ACC0E4B1C38C201A780FCF5CA727BC0156A4545AE0B168AB9A7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4820

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

A493.tmp

Path C:\Users\Admin\AppData\Local\Temp\A493.tmp
Size 486KB
SHA256 8b6fcf5b3e1b9365842423502c405a91077f37cf1d5f6ae9b66b97ea0e06ff2b
MD5 d85e966b88c8b3b3fa4bd719e9c1c82e
SHA1 95880e8e4cf4fc90776a0c4e6565abaaad5c8ddf
SHA512 bf5a8976a196c3a18a39928eb3ef0f5cf93c212073b6139c5fc77aaa42895bf15c898b37ce2f3086cfde947d1a89bf20204add9dd0d2cec2a8b3da3a7cf5ed9a
SSDEEP 12288:3O4rfItL8HPfmKUa+Rat4FDiMI7rKxUYXhW:3O4rQtGPrH+RZFDiX3KxUYXhW
TLSH
T12CB4F12AB641C233D28302751BDADAD6A73E79710329D4C33BD4427D1FA1AE1D77A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download