a9ccc1d1ba33338d7625ffdfb738d84f986f6bbc2339491c4b9ada05559c9546

Analysis

max time kernel
150s
max time network
140s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_334b86a06d28e86400a75650933754d6_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260720-r2spdadv9p
SHA256 a9ccc1d1ba33338d7625ffdfb738d84f986f6bbc2339491c4b9ada05559c9546
MD5 334b86a06d28e86400a75650933754d6
SHA1 c7e18de3a7b8ad6f5eb3dbdb04b23e94aabc6189
SHA512 58db68f9597c4173c78168452c2f0023568ea1e4ff37999d9798fb92253348077da668389252e86004a3eab0328fa2624c64a664895a32122bc14e4f56b966d2
SSDEEP 6144:t/AyW4otycLc3qQeku+/g/tBYdp1avbBeU3befh8qESi8z1GeGnDjbUwqIztwCk:ts4acekuGg/ty1cBeUW8qEWRGewnCX
TLSH
T15C94E0213686C036E2A605344BE5DB7A59397DA05B31A4C73BC02BAE6F752D2DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
932	3965.tmp

Executes dropped EXE 1 IoCs

pid	Process
932	3965.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_334b86a06d28e86400a75650933754d6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3965.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5168 wrote to memory of 932	5168	2026-07-20_334b86a06d28e86400a75650933754d6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_334b86a06d28e86400a75650933754d6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_334b86a06d28e86400a75650933754d6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5168
- C:\Users\Admin\AppData\Local\Temp\3965.tmp
  "C:\Users\Admin\AppData\Local\Temp\3965.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_334b86a06d28e86400a75650933754d6_elex_mafia_stealc_tofsee.exe A468D777FE9917701F1D01B68801BBD778EB06B587B8E6721B561DF46AA65FBABEFCC3006E3DD839A5092860635788A4C3E294B05EBCDEA3DD27D4BB685170A0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3965.tmp

Path C:\Users\Admin\AppData\Local\Temp\3965.tmp
Size 435KB
SHA256 afdfb23e41dd9f962137f65c08a3532d3fa41997005381948c9f1c6ee3086970
MD5 ea0e8e979158fc9543095d89f17bceeb
SHA1 ae973184bc9da70c688f9ac4803721212a8fce77
SHA512 399f5e8a22ee3b2af8ed778addbc832c801c623738915801c9e5a957af94ac7afb2fa739a096d6e12f0015007d66fde56bafddb57520f1003f5c243ce96c1a4e
SSDEEP 12288:ts4acekuGg/tzb0JJ+ROnHovYfeP4veJIX:ts4aceku/tcJoOHHle
TLSH
T1AF94E0213582C037E1A709348BF1DB66697A7D654B32A8C73BD42BAE2E741D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download