30b80b361e7b8e7e305c9a4c112d0c5c40942e842bc15db2941bebe896063bf7

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_8607bac35af0194cc0dc492c8b9085e3_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260720-rrl4vaez9w
SHA256 30b80b361e7b8e7e305c9a4c112d0c5c40942e842bc15db2941bebe896063bf7
MD5 8607bac35af0194cc0dc492c8b9085e3
SHA1 015a51c87bb2dad60e33cd01689c7076e5ca2c56
SHA512 2b91dfd32d2e4c2e07fdafe0047dde4e5d3a924c69b6e539914580ae45a8d36c6a774362a6ec23c4ed0d89f74bc010ec53fafce5f7d582635282be4a41e0eebc
SSDEEP 12288:bO4rfItL8HAVQRcsoWsUnCaXHIx1kA75UO:bO4rQtGAmoXFx1kAVUO
TLSH
T132A4F12976418133D2A302740BD6D7A5AA3E7970573664C33BE8027D2FA57E1D73A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4960	3743.tmp

Executes dropped EXE 1 IoCs

pid	Process
4960	3743.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_8607bac35af0194cc0dc492c8b9085e3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3743.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4960	1196	2026-07-20_8607bac35af0194cc0dc492c8b9085e3_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_8607bac35af0194cc0dc492c8b9085e3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_8607bac35af0194cc0dc492c8b9085e3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\3743.tmp
  "C:\Users\Admin\AppData\Local\Temp\3743.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_8607bac35af0194cc0dc492c8b9085e3_elex_mafia_stealc_tofsee.exe 3AE8FB6D3D2FC6045D7DE3B30F194AEB8F48CE8F2563714A98E071ABFA3F178B44E861849C4B0BE4B3066600DD518AA6EBBED08CFB5529937B6550959219CD21
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3743.tmp

Path C:\Users\Admin\AppData\Local\Temp\3743.tmp
Size 479KB
SHA256 de586069f9f67945cdcbdcf5e48296fc4153d86f56f211758afee15b9fb3ad49
MD5 592aaee6d3f357e78e0b8993da73bf2a
SHA1 4a8d54a6059d72b2c34cf32a15b37500054d4e3c
SHA512 d50d0f2f310a4686db391c336a3d16404b541f0dc488d2c2d5ad0b479afdf22fa2d8999dd0ea254ff03d05a346d10cf444d80833b64b1ca9880a8a6a7a5d1f4c
SSDEEP 12288:bO4rfItL8HALUWhfYR7k2c+7B+euepXGs3CG75UO:bO4rQtGABhU7pcuDuiX/VUO
TLSH
T1D8A4F12AB6818133E2D301745FD697A6A73E75B10726A4C3379402BE1F617E1D73A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download