9245a5338f5bb91e21e54f317e0d4cffe944da3d19c406c62e33a12cb737f647

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 14:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_579b6f9c3a2841985386e944f94c70ee_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260720-rxnvmads8r
SHA256 9245a5338f5bb91e21e54f317e0d4cffe944da3d19c406c62e33a12cb737f647
MD5 579b6f9c3a2841985386e944f94c70ee
SHA1 c39a1a9d7b3172a9fdfd1c37e9d52d3a448bf50a
SHA512 ba151897aaf81cd4c4a409bd13d4b0d4a1ca34699e0b8087ad8895a5aee749c0660208e5a643038dcd1d231e246cc2a17824e1757b0f3d71a78e5a39967ff5f9
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStngICnfZssX+WyTkixDVsKEPmJNNRcYGIOJ5:Nb4bZudi79LRX+WyTJRzVjOvm7n7A0a
TLSH
T180A4E0203182C037E26712344EE6C7B56A3A7CA15F61A5C73BD07BAE6EB02E1D674357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1432	749.tmp

Executes dropped EXE 1 IoCs

pid	Process
1432	749.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_579b6f9c3a2841985386e944f94c70ee_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	749.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1208 wrote to memory of 1432	1208	2026-07-20_579b6f9c3a2841985386e944f94c70ee_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_579b6f9c3a2841985386e944f94c70ee_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_579b6f9c3a2841985386e944f94c70ee_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1208
- C:\Users\Admin\AppData\Local\Temp\749.tmp
  "C:\Users\Admin\AppData\Local\Temp\749.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_579b6f9c3a2841985386e944f94c70ee_elex_mafia_stealc_tofsee.exe A31BEB7865B3E3D7CA94AD3301B3159A2B9BB30A4F27724970D7F04DD432DC6FF010F6F317D8D8901514B43B8C11CC5DAB80EC2EB2F8832C70DB9769FCB7BD8E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

749.tmp

Path C:\Users\Admin\AppData\Local\Temp\749.tmp
Size 473KB
SHA256 f0745e0f49c8e8b2250fe086ca5c29f24272f0d55b5a02a16544a07f2b627dc7
MD5 e0ab7653afebd9a04e144a597643bc55
SHA1 cdd7ce7bd9826bcddbb4102b0c09eb1636aa0d47
SHA512 447428293a17330a54d32d5d2d0fda48805460d0c96788117e9cf06571a4300afe7e3fafb3e765f78b44293b93ff7433bc9e7a1c1fe5f919df75cdbbe3fa3cc8
SSDEEP 12288:Nb4bZudi79LLEx4/iJ97uAkj18ot7lUA0a:Nb4bcdkLLEx4u7cjXdlf
TLSH
T10AA4E0203582C037E29716340AA5C7B56A7E7DA19F76A8C73B94377E2E702E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download