a547ccbdefe77d7403808f3e816a27b3ac658c55ffdb29b3c6fdb321583d1685

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260720-rx4abaft3x
SHA256 a547ccbdefe77d7403808f3e816a27b3ac658c55ffdb29b3c6fdb321583d1685
MD5 536bd606b5293a7e0c6bc3626cd3fe2f
SHA1 d8bccda269be20c04ee566b35f641798e9b2dcf4
SHA512 942e9098b0b8dc819287a61398235eafc13e7d024245c592d17633d41f8ad9aa9e398cbd72b4f83f6932c6c7fca53b5b5bec4ab939c16d8e8f60e37c75a14740
SSDEEP 12288:bO4rfItL8HAdFEGG3hg2CJdP7mLXnlGXNHot75UO:bO4rQtGA7RG3HWTmLXlGXutVUO
TLSH
T16CA4F126B681C133E29302750BE6D7AAB73E39B50726A4C33BD4026D1F616E1D73934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4636	2234.tmp

Executes dropped EXE 1 IoCs

pid	Process
4636	2234.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2234.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2648 wrote to memory of 4636	2648	2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Users\Admin\AppData\Local\Temp\2234.tmp
  "C:\Users\Admin\AppData\Local\Temp\2234.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_536bd606b5293a7e0c6bc3626cd3fe2f_elex_mafia_stealc_tofsee.exe 0F1B2DDEA9AFE5B4433787C8EE797DAC69ED0B36FFFFD82912ECC7553164C82AE90BE1977B264CDC99A424BA899DFC4DD84F797438D1ACDDCC12E0F05CE3435D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2234.tmp

Path C:\Users\Admin\AppData\Local\Temp\2234.tmp
Size 479KB
SHA256 4c8cd7d3f242525d575e381e3c3429284cf3178999c3e42002098fbb2caf33ad
MD5 437fe4c73f596198418cebc5affc6c23
SHA1 97ae7f9f5edad87c6c1145154a3394278d396b92
SHA512 87ba33a848e8d0d781cf92c3dabc8c16a742a71e88f7e93904e5638fa345b2122e0cd7939e43aa9c0656a630812b2c5dd40ff676c0b66e266df022a494be4eea
SSDEEP 12288:bO4rfItL8HAIkyhEfCfgBXFzIYveSRhBPbtY75UO:bO4rQtGAIFW6ovPBYVUO
TLSH
T121A4E12A76818133D6D302711BD6DB96AB3E75710726A4C73B98463E1FA07E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download