7d4dc715c22b1330cce971646dfdb5b15a2a4199227bcc7c114ab0a1c9c5e50a

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_333dc41e682443e0cdfb5a1d056721e5_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260720-r2txfadv9r
SHA256 7d4dc715c22b1330cce971646dfdb5b15a2a4199227bcc7c114ab0a1c9c5e50a
MD5 333dc41e682443e0cdfb5a1d056721e5
SHA1 3b6df37b3642752fa351004bf845717079b80786
SHA512 af56d854c64071a82fbfa2ffe08ecc8255b152ae747f917c059859f6c8ee5c5e3b38aff2f150b02eae2c15b58e22db76ab376a1e65f39b9908d0e243169468df
SSDEEP 12288:Nb4bZudi79L8GJR1VxuX9gZIAFb7N0HMKXEDZfOYA0a:Nb4bcdkLvJR1zuX2Z7B59ZE
TLSH
T178A4E0243581C037E2A716394AE6C7B9563E7CA05F2268CB3BD437AD6E702E1DA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2496	2C85.tmp

Executes dropped EXE 1 IoCs

pid	Process
2496	2C85.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_333dc41e682443e0cdfb5a1d056721e5_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2C85.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 2496	4900	2026-07-20_333dc41e682443e0cdfb5a1d056721e5_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_333dc41e682443e0cdfb5a1d056721e5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_333dc41e682443e0cdfb5a1d056721e5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\2C85.tmp
  "C:\Users\Admin\AppData\Local\Temp\2C85.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_333dc41e682443e0cdfb5a1d056721e5_elex_mafia_stealc_tofsee.exe DC034521D8AA919F61AF97660EC2AA8F54CB22655F28E12347B6886A6AAA0610FE7D9D328EE3E7D12C5F5F56C9C2A833BA9103CDD5C4C9E477663AAC5F4994F6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2C85.tmp

Path C:\Users\Admin\AppData\Local\Temp\2C85.tmp
Size 473KB
SHA256 34678f3819ae852fe7ad37ed0a46a0be4271791e77e9431d0ab56df1ecafa51d
MD5 098ee8e41925f559f7f7d1fc2a9d769b
SHA1 b8199beee0bf954c80a56f1f1f78fe231f8d9667
SHA512 327873c15bf37e26be2a0391d60c8bd62ce8a2f9d4f71cba08af8df7c20e8621fb5c50a74bb86ece864c97553bb4a1df20b13a9adb8f9b5ef3b29d1ff80336d2
SSDEEP 12288:Nb4bZudi79Lk4IU6YonbAzqst67cGg2Ip/sAA0a:Nb4bcdkLeb5sQ7cG8R6
TLSH
T1C5A4E0243581C037D1A706354AE6CBA6657E7CB15F61A8CB3BD03B6E2EB02E1DA35317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download