fa9806f1a7df025877cb3efb5684b79e67953bc0cfb0113ed2da3c96db234741

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_6d1863e76fc59de57b78d631c386c0c9_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260720-rt9mxse19z
SHA256 fa9806f1a7df025877cb3efb5684b79e67953bc0cfb0113ed2da3c96db234741
MD5 6d1863e76fc59de57b78d631c386c0c9
SHA1 4f47f69ef4a3f18c050d5b3802274594f8eb8873
SHA512 9feb91d0e90a84ab712c72f632b6a982156038fd42203ea7f5f95c06bfad689503095f2ef37c6f1f584368fec8eb53af64a0b3b3f2ed5285dd2c95a7798e8857
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStpY2kTq4A9ulEdhyakKgnETlOqkLZ/M/ISAN:Nb4bZudi79LsKG4tlEd/EETlzkNkA0a
TLSH
T1C9A4E0243582C037E29716380AE6C7B5567A7CB14F6268C73BD03BAD6EB02E1DA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4508	2820.tmp

Executes dropped EXE 1 IoCs

pid	Process
4508	2820.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_6d1863e76fc59de57b78d631c386c0c9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2820.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4956 wrote to memory of 4508	4956	2026-07-20_6d1863e76fc59de57b78d631c386c0c9_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_6d1863e76fc59de57b78d631c386c0c9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_6d1863e76fc59de57b78d631c386c0c9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4956
- C:\Users\Admin\AppData\Local\Temp\2820.tmp
  "C:\Users\Admin\AppData\Local\Temp\2820.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_6d1863e76fc59de57b78d631c386c0c9_elex_mafia_stealc_tofsee.exe F7BF8C7B3C722C9EE249305C2C48D1B1CE09888E0932D88836F464DE476383BB3F10F53183B2C8264A2AC30B0465C61002EBD025BCF452951A03AA3F8405F790
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2820.tmp

Path C:\Users\Admin\AppData\Local\Temp\2820.tmp
Size 473KB
SHA256 2a8ee58fe47186115806a2d8a63e2a3dad55175d1cf6ae3440ea826ad50b5b71
MD5 97e4659ded5d062197c8e96bce8bd569
SHA1 29a35262b48bb2439b4459996389097465dfe66b
SHA512 4db1d3339efbae72b4275d80d0598863a1cbad69ceda911c45ba1439cc392d4e75ad776d0cc51eeac03a44efe506920305a2af4312a0b145c58250e3b1005c20
SSDEEP 12288:Nb4bZudi79LMg99Daguno4/4131R6U+VL6A0a:Nb4bcdkLlagYopF1R6Rl
TLSH
T1DEA4E0247191C037E2A706344BE9C7B5663A7DA19F2164CB3B917BAE2EB03D1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download