785a7aee366fc4db26c14e54c4776071c699280e7be8dd55f87cc73820387339

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_7b21713c0b978a665dd2d5044c727df1_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260720-qbdl4ads7x
SHA256 785a7aee366fc4db26c14e54c4776071c699280e7be8dd55f87cc73820387339
MD5 7b21713c0b978a665dd2d5044c727df1
SHA1 715c8c286d8bb1800037869bd0e3e0210e9b7c46
SHA512 6ee59d4ef4890b35483324e6f243a463128f1e8406861c36ead785b0cf4791c072ad34e16f8f076cc033198949a4e78dc2815b166f1fe44c8d56bf8cf7594652
SSDEEP 12288:Nb4bZudi79LlFHEylsRimi1A6pGJxr3A0a:Nb4bcdkLlFHR6RSA6cJxG
TLSH
T1DDA4E0243581C037D2A706344AE6DBB6663E3DA14F2268C73BD4776D6EB02E2DA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4888	E114.tmp

Executes dropped EXE 1 IoCs

pid	Process
4888	E114.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E114.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_7b21713c0b978a665dd2d5044c727df1_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4888	4496	2026-07-20_7b21713c0b978a665dd2d5044c727df1_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_7b21713c0b978a665dd2d5044c727df1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_7b21713c0b978a665dd2d5044c727df1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\E114.tmp
  "C:\Users\Admin\AppData\Local\Temp\E114.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_7b21713c0b978a665dd2d5044c727df1_elex_mafia_stealc_tofsee.exe E3A48B0068F09BC9651221F70E885E5D1F2E82F2A618E765792E405EC8F6D7C1801BCE98E7E19AAD5565580C3C3B3149F20AC29DD98F4D350F2889A13F58FB61
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E114.tmp

Path C:\Users\Admin\AppData\Local\Temp\E114.tmp
Size 473KB
SHA256 03f0cbaff04433fb47983451907f69aeb32427c3e092a8a0f7ed2bf890997c58
MD5 ae4753b9aa7cb97879cde2e8306569ae
SHA1 8ea2742ae764762498f501c8d724d588dfb58c0d
SHA512 db9bb78f8b0d3423f6afa276aabf9ad6644073750ffd0f079a877c5cf9087c63a9be456df20871949be62a1f890cb09fe0904d336192f18199e44f9c692656a4
SSDEEP 12288:Nb4bZudi79LQ+IQ4Q+kjUD4G0zCI6SJr2zKRjRD0A0a:Nb4bcdkLQxQ+kjHG0zCPSJT/
TLSH
T143A4E0247181C037E2A706344BE6C7B6653A7CA19F6268CB3BD4776D2EB02E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download