1bc412b7c9b00f100366030b511cbdbe28cbf363bc13737cae9cfc5bdc05c2c2

Analysis

max time kernel
148s
max time network
119s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260720-qmapksbw3m
SHA256 1bc412b7c9b00f100366030b511cbdbe28cbf363bc13737cae9cfc5bdc05c2c2
MD5 1a9a3a0f074db4c24d3159ac5e163a25
SHA1 3e28f4322fd050ec94fa7652269686e6dd74c43a
SHA512 c23e3855c4d1fd7a0a4bc174b3f939fde7ab80a696df973369daa6d24a577f5e205fa024f5a9c8e833a7c2cdba8c4ee026fa51eac8695d279efc879ab2cd94a8
SSDEEP 12288:qO4rfItL8HGZ852M6p8ehaBUk4gOt7bWmeEVGL:qO4rQtGGeb6p8ehaBUxumeEVGL
TLSH
T107A4E12A7241C133D29302754BE6DBAAA73E75B5432694C37BE4427D2F612E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1812	E8D.tmp

Executes dropped EXE 1 IoCs

pid	Process
1812	E8D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E8D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3308 wrote to memory of 1812	3308	2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3308
- C:\Users\Admin\AppData\Local\Temp\E8D.tmp
  "C:\Users\Admin\AppData\Local\Temp\E8D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_1a9a3a0f074db4c24d3159ac5e163a25_elex_mafia_stealc_tofsee.exe 1544B23CB2EF7EF249F5229E881AD35DD99FDF7A996F0BE740B9126D05AC5E2C6DB8AFD011094B8402AB236B64BF1FED20A8FAF6C0B2408B7E299B77C65FCDF6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E8D.tmp

Path C:\Users\Admin\AppData\Local\Temp\E8D.tmp
Size 468KB
SHA256 fbda0663c9e0bfa07357306fc3b7bccee413563a8f86e4bc0ed21d92e03d19ef
MD5 456a231dcc34f89d5f27e0b86d43e7c3
SHA1 8726b2ee03bab2e9639cd46b31af60ddcf6f1d73
SHA512 1356de5635271ff8b904ad6f3a18f82ac59fcc0ac0e4c21c08481843c6079a5e7dc60598520174b8f591df449aae0330d9fd4104ee62195cc899490656e7e68c
SSDEEP 12288:qO4rfItL8HGHIePeP5Djtx0LkFRZLnG7bWmeEVGL:qO4rQtGGHpP85D6kFRxGumeEVGL
TLSH
T19AA4E136B2418133D29302755BEBDBAAAA3E7571432694D33BD8027D1FA16E1D336347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download