701d5ba370bda7b7714218f43adf309e4f04b8f44c5e330631305471f6c1d2b2

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_805658ce4aef9ae03a2a7b84389e08a1_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260720-qa2yasa15k
SHA256 701d5ba370bda7b7714218f43adf309e4f04b8f44c5e330631305471f6c1d2b2
MD5 805658ce4aef9ae03a2a7b84389e08a1
SHA1 f1c88dacdf603d8d23a760e3ed67da75410e8bf3
SHA512 6a664e30f21a4497c2fdac91de528f147a62cd3e0cdbd45fa8233bdfc6d3fffdcdd9d43b60fd5adbbf32b1d047d96d8914c1de7e91916c48dc27c06cf48736cc
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBY+U521V4XJFtGgDgyZU1ahhg3ndow9J:fd4x+ePixnXQjC47YlfXhWdowP
TLSH
T15B94E0213586C036E2E205348BF5DBA6556E7DB40B36A4C77BC42BAA6F702D2D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5256	1D04.tmp

Executes dropped EXE 1 IoCs

pid	Process
5256	1D04.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_805658ce4aef9ae03a2a7b84389e08a1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D04.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 5256	2776	2026-07-20_805658ce4aef9ae03a2a7b84389e08a1_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_805658ce4aef9ae03a2a7b84389e08a1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_805658ce4aef9ae03a2a7b84389e08a1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\1D04.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D04.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_805658ce4aef9ae03a2a7b84389e08a1_elex_mafia_stealc_tofsee.exe BCA306B6D3F151EF19345A3766CBF0792529501192CB29C1F9C18C927EEFDFDE4A0ED2231A01CD4D42379DE634FC536220ED01C492C01160DF675C81B648F0EA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1D04.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D04.tmp
Size 435KB
SHA256 fd9551ed8cb4c1833c83489de42b71844260e7e6ea58a2c4ce4a2f5302ea5218
MD5 6b2feaa407dc1268ce4bf7e0e9b0826d
SHA1 fc35e612a8ce4170aac018db4eeb0bfbdf2c8372
SHA512 b250e9000c20d3f7657f85d0174a73cfcc6562fd7c4b58061c6e95b82cb94eb621928ca99324baf0ca42ecf523d7eb63156481932d740859b0dfd4219b182018
SSDEEP 12288:fd4x+ePixnXQjIHR9M2jdnWLgFQaZLgKH6WjbystqomsoZeGpaLwP:fd4x+ePixAjgR9M2jdnWL+TZkKakGLo9
TLSH
T16C94E0213186C036E1A305344BA5DBA9696A7DB04B36B8C737D42BBE6F742D1DB3431B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download