c8df419a32a4f1ff8e343eef843330aa088fcf27d0774ab046455ac922485cc4

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 12:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_fa51dc8ac19ef326c2f533f5b4db149d_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260720-pwt9xaav6p
SHA256 c8df419a32a4f1ff8e343eef843330aa088fcf27d0774ab046455ac922485cc4
MD5 fa51dc8ac19ef326c2f533f5b4db149d
SHA1 949953da1ca7472ccfacbfb36b4ba7a281e851c5
SHA512 2cbba313fac8d59f0816c97ca36e9cf4ed622769ffe99a6dc7080bf2967f2fd7fa53cb2d6c77c4a7274a20319b785eaaa4cb0f398d788c35968fc3549b2d37fa
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStmNlx33TEzm3Q8BJDNTKxjd3WZxC799vWSA:Nb4bZudi79L9jEzmg8TscLCRZlA
TLSH
T178A4E1203481C037D6A71A394BF5CB766A3E7DA14B2568C73BD06BAD1EB12E1E231753
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3896	8B00.tmp

Executes dropped EXE 1 IoCs

pid	Process
3896	8B00.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_fa51dc8ac19ef326c2f533f5b4db149d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8B00.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3448 wrote to memory of 3896	3448	2026-07-20_fa51dc8ac19ef326c2f533f5b4db149d_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-20_fa51dc8ac19ef326c2f533f5b4db149d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_fa51dc8ac19ef326c2f533f5b4db149d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3448
- C:\Users\Admin\AppData\Local\Temp\8B00.tmp
  "C:\Users\Admin\AppData\Local\Temp\8B00.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_fa51dc8ac19ef326c2f533f5b4db149d_elex_mafia_stealc_tofsee.exe 7A5C4708D1D056F9F503E0772304C29B0138E33EFAD9C10BEBC1B473E89AF01A17B521E9F57A8F5F82561BEEDD55BF7ED725AEA312FDC7053DA2DDB7857C5F5E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3896

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8B00.tmp

Path C:\Users\Admin\AppData\Local\Temp\8B00.tmp
Size 444KB
SHA256 87e29fc5d480ee69eb38882820af2edc3026bc47a932776ea8ffb002f23f7218
MD5 6d8838e74e9d7c7e89e955842f2e9aaf
SHA1 81e3583e35ce158f5ed0f711041468176fab55ab
SHA512 ce250b7e006271d3998f84b7738935330a1eace0f6efa281e69a62a70e852c4c5cddae83af4736bb33ac63b894472c1d8cf91058af51e68ad42c4ca94b77c629
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iSte2CYH2KhOB031FuLxHUr3kSv43YbQwsbRrT:Nb4bZudi79LJnYTA4+MUSv43YARWA
TLSH
T189A4E0243581C037E2A716354BE6CB36653E79B14B2668C73BD02BAE1EB02D2E735357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download