c369c26a2043694cf52dfb46498bd4972b2312730ebf3b0315dea3f59dfabb49

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 13:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_0a3fc824d527f024d29c4e78f559db4e_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260720-qpbdwsbx2r
SHA256 c369c26a2043694cf52dfb46498bd4972b2312730ebf3b0315dea3f59dfabb49
MD5 0a3fc824d527f024d29c4e78f559db4e
SHA1 4109e9cfc6e8927cc151ad6cfda40a219427ffc1
SHA512 45333070cc61ac95019ad12b3af595bf7c9640be624e5fba4e57f0afe691b5c7383f188c8c11826f00c005ed848d12b09a06e5af828cec03d6fc9e7205bc3ea2
SSDEEP 12288:Ci4g+yU+0pAiv+lsZ/8lcroF1Ss+vJd1tjeXmeEVGL:Ci4gXn0pD+2Z/hsm1homeEVGL
TLSH
T112A4E0297142C133D29202361BEAC7A6667E75B64722A8C73BE4077D2FA17E1D33534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3076	7C6A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3076	7C6A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7C6A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_0a3fc824d527f024d29c4e78f559db4e_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4924 wrote to memory of 3076	4924	2026-07-20_0a3fc824d527f024d29c4e78f559db4e_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_0a3fc824d527f024d29c4e78f559db4e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_0a3fc824d527f024d29c4e78f559db4e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4924
- C:\Users\Admin\AppData\Local\Temp\7C6A.tmp
  "C:\Users\Admin\AppData\Local\Temp\7C6A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_0a3fc824d527f024d29c4e78f559db4e_elex_mafia_stealc_tofsee.exe AEE3BE153C402B0D7BFA68AEA0393898785B75010FCF97C9E0DE4DE58592D9C8633930F3422694493778D08D92D27DB177B8DDF4330985DE949D26A910253C74
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7C6A.tmp

Path C:\Users\Admin\AppData\Local\Temp\7C6A.tmp
Size 468KB
SHA256 959518e5960230598f5b14c94b9e36781e68078c5dd217ca4adab06c5fee13d0
MD5 9ec0cf818da184a29664699410525f79
SHA1 87ed5e66e6f35767f389f655aa308fd7a14cdc5d
SHA512 e7df1fa796d170ffe820ec6c5f2aec2ebced953ab86b34ddf5a23dd05564f6850eb6f71ef3244b71b5f78505ebb98fee58980d3b2ebd23571e9a746627743d36
SSDEEP 12288:Ci4g+yU+0pAiv+VlNKYy85e9doDUgDllXmeEVGL:Ci4gXn0pD+VlcY7AduUcmeEVGL
TLSH
T1EEA4E0353546C133E29306350BE9CB96A63E78B50726A8C76BD4067E2FA07E1E73534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download