cdb0bb85bbe1663036364da17befab84430bcc13b02a9349a2636f831c819ba0

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 15:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b821d21a9ab27853fb009c9e8abfa8cf_elex_mafia_stealc_tofsee.exe
Size 613KB
Sample260720-s1cgfaex6m
SHA256 cdb0bb85bbe1663036364da17befab84430bcc13b02a9349a2636f831c819ba0
MD5 b821d21a9ab27853fb009c9e8abfa8cf
SHA1 7ba4a7dd7c70cac1434806cff72e56aa20d2a23c
SHA512 ad29bcb41e24c3e3ad13df6e2a8d5f2c664f5d48cb19de850446551816bdfab115b417473ce1a5dd832ff6d3d55fce0355a6a80a3582a27f828bbc6ec3e8f7db
SSDEEP 12288:XO4rfItL8HP94YejVBg+Hg1UEJ/27Q8mO4rfIt+2:XO4rQtGP9RaBF2UE12dmO4rQt+2
TLSH
T1EDD4E025B340C037D6A521355BE3EB69663A7D740B12A5C33B9027BD6EB02E2D73934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2520	7D6.tmp

Executes dropped EXE 1 IoCs

pid	Process
2520	7D6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b821d21a9ab27853fb009c9e8abfa8cf_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7D6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4348 wrote to memory of 2520	4348	2026-07-20_b821d21a9ab27853fb009c9e8abfa8cf_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b821d21a9ab27853fb009c9e8abfa8cf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b821d21a9ab27853fb009c9e8abfa8cf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4348
- C:\Users\Admin\AppData\Local\Temp\7D6.tmp
  "C:\Users\Admin\AppData\Local\Temp\7D6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_b821d21a9ab27853fb009c9e8abfa8cf_elex_mafia_stealc_tofsee.exe 2D6D758FA7FE116877B16CB8631EFE604D5332757E72FF4DBEC0596CC6C53C8468DC32B345DCFC6CF52BED6B6222C5BB7D764A3EB846A8D0743BC1A466C3C8BC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7D6.tmp

Path C:\Users\Admin\AppData\Local\Temp\7D6.tmp
Size 613KB
SHA256 bc82a6d9afc6942b9e4ed1a86e3cb8fee5727536d13ac76ca2e1209305975377
MD5 6907ff7c5a16ba219f075fca0b16aa6c
SHA1 dcadc039e6d497814640cb52a82d23d42b3e9f46
SHA512 649f4cc74da6ddbcc47b99125b3fbc467a69db73f03250308afc7ceb7eb9c05b29091b1247f8cc2bc40a109582929c3284c417ec3d5420989b3edd06bbf42d9b
SSDEEP 12288:XO4rfItL8HPN1P7JsQZwh2cP/wNWpUmov7Q8mO4rfIt+2:XO4rQtGPN1P7WQbDNlmovdmO4rQt+2
TLSH
T12FD4E115B340C037D69622359BD3AB69567A7D740B12A1C33B942BBD2EB02E2D73D34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download