a78ea65940345128e0e57ec63161da36538d54ecf7e9f3abd43b5198190ba679

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_f4cd7dabe83f611e56a16dbae223666a_elex_mafia_stealc_tofsee.exe
Size 448KB
Sample260720-rb255aet6s
SHA256 a78ea65940345128e0e57ec63161da36538d54ecf7e9f3abd43b5198190ba679
MD5 f4cd7dabe83f611e56a16dbae223666a
SHA1 1a2638a656ce5f9fcfc86d627d28957ad38f4885
SHA512 7fb8e4709926dd556f156d4760f3b0896a053e2b1dba3f81887f2fa184ca1b333139169b2b44bb1edaf9c99291c58a71629d16d7217fea6be36a86f9afaa2701
SSDEEP 12288:lb4bBxdi79LeU+FvcgrPIXpYuJC0Wcq3K5Pp71:lb4b7dkLqZsZYu/3
TLSH
T11EA4E0243181C036E29325390AE5CB72A5BA3A614B21A8C73BD8DB7F5E746F1DA35353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1088	2EE6.tmp

Executes dropped EXE 1 IoCs

pid	Process
1088	2EE6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_f4cd7dabe83f611e56a16dbae223666a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2EE6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1652 wrote to memory of 1088	1652	2026-07-20_f4cd7dabe83f611e56a16dbae223666a_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_f4cd7dabe83f611e56a16dbae223666a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_f4cd7dabe83f611e56a16dbae223666a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1652
- C:\Users\Admin\AppData\Local\Temp\2EE6.tmp
  "C:\Users\Admin\AppData\Local\Temp\2EE6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_f4cd7dabe83f611e56a16dbae223666a_elex_mafia_stealc_tofsee.exe 7C8E3EDA195A9F25A22FAD8334CD5B47A88C5FFC969721A6FB4FB615FD0EFFFFFAD777A68356AB07E672E1F846E56769FED028A58F085749DDEDD288FA116402
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2EE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EE6.tmp
Size 448KB
SHA256 5c3684f9f5dacc809a62e7d3aba9c20f5403e8241cab1f9df18a94afe79472ef
MD5 3068ac03833cdb087ba8753e69d664ca
SHA1 fd4dba2411f31b5adc03259997288b595829ae2f
SHA512 a612c339a1fc3d9009d570ca937c75d8915025d6a252c3acb15c81036cd51eb588ca241fd702ec28eb102e8b199cc8009f7cbaa7b3cfb9aac5836659c17b9583
SSDEEP 6144:3FrJxvldL4c5ONK1tgRbd1s79+i5+Ry2jxIss95rNRw0z+knmCurJgxdkxd4tPd7:lb4bBxdi79LoxParNR5z3mSeHM17
TLSH
T125A4E0143581C033D29726394AE9C772E5B939A04B22A8D73BD4EB7F5EB06F1DA35302
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1088-5-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1088-8-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1652-0-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/1652-6-0x0000000000400000-0x0000000000479000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads