463583ffd4acc3176300c0eaf637446da78491f1b23456ecee51c683bf84b265

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_8026a73aabfe0c795e0fc06a9bb57dc9_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260720-v1pg4sbs9s
SHA256 463583ffd4acc3176300c0eaf637446da78491f1b23456ecee51c683bf84b265
MD5 8026a73aabfe0c795e0fc06a9bb57dc9
SHA1 93e5e49b752573cf00e09953e9c4eb13009d91c7
SHA512 72de0d56e3dbbe41fa39d78aa1a2e47f0664df8eb8d0c6d31be18c76196b93637ada8d55340681cf1aef96ce41128e82d020ed3b597da62061b3a1791b825da8
SSDEEP 12288:bO4rfItL8HArvvVwzA0fYYJx5lyIKkTVx75UO:bO4rQtGArv6zA0fYuyIKcVxVUO
TLSH
T159A4F12A7781C133E29302751BE6DBA6A63E78710326A4C77BD4027D1F656E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5584	2706.tmp

Executes dropped EXE 1 IoCs

pid	Process
5584	2706.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_8026a73aabfe0c795e0fc06a9bb57dc9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2706.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4640 wrote to memory of 5584	4640	2026-07-20_8026a73aabfe0c795e0fc06a9bb57dc9_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_8026a73aabfe0c795e0fc06a9bb57dc9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_8026a73aabfe0c795e0fc06a9bb57dc9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4640
- C:\Users\Admin\AppData\Local\Temp\2706.tmp
  "C:\Users\Admin\AppData\Local\Temp\2706.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_8026a73aabfe0c795e0fc06a9bb57dc9_elex_mafia_stealc_tofsee.exe D9C76CE39B8D978895DC03640300495CA6937758F8964E8307F7EC5EC25A346B6973BE622CF46E95D8B9362D5FA3017A19DFF2D4AAD8BF1818D159CDC725A17A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5584

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2706.tmp

Path C:\Users\Admin\AppData\Local\Temp\2706.tmp
Size 479KB
SHA256 b104ed61a65815cdb1dde32a5f2d93e07d56fa8065d6c34956305ceae3476d19
MD5 25664559e10626910bf02c01b513b00d
SHA1 19dbdee3aa4efe7c37e7e93723c80ba814f924c8
SHA512 70d06a67636a38ffc5ef4813a4491bb86adbb9665578306d16589b66e9fef91caf0c770dfb1ba0f237790e7a25d11de5d0247c3535d45f9b05685ab45519280a
SSDEEP 12288:bO4rfItL8HAocA7IsRHbHrLymdvA3WW75UO:bO4rQtGAocmkM+WWVUO
TLSH
T122A4F12A7741C133D69302750BE6EBAAAA3E74701726A4C73798427D1F60BE2D37534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download