3c9a5ff027834d32da0fc31ebd9645a37d226533eb83ade60d470cdcec87361f

Analysis

max time kernel
150s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260720-vn5cssay4z
SHA256 3c9a5ff027834d32da0fc31ebd9645a37d226533eb83ade60d470cdcec87361f
MD5 b0763d3db02b8d8515d3161cda9a255b
SHA1 dc9c23adb26487d40f0b917bb95f476adde59c95
SHA512 e7949ff81f6e3cf0b7c2e141023aadd896a0b0577009533678cf42d66bb571edc30abc6978e1c447608f3fea15f7aa63cf7b79f9f75f526547f4e3b6e8ca460a
SSDEEP 12288:qO4rfItL8HG/zEV30RTavfV1EApbT1qoL9oGvVPKs7bWmeEVGL:qO4rQtGG/zi6TmuybR16GvVPKsumeEV2
TLSH
T16BA4E036B281C133D19302754BDADBAABA3E78B54326A4C37BD402BD1E616D1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4028	E332.tmp

Executes dropped EXE 1 IoCs

pid	Process
4028	E332.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E332.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4952 wrote to memory of 4028	4952	2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4952
- C:\Users\Admin\AppData\Local\Temp\E332.tmp
  "C:\Users\Admin\AppData\Local\Temp\E332.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_b0763d3db02b8d8515d3161cda9a255b_elex_mafia_stealc_tofsee.exe 0B2C1E709BADC198693EB5DE5E5FF8EFC08C91C9A737E97FF74F8B2DD7D0F06C0F9BF4E8C9FC179FED51D974F4DB8E31F38231245CF5CD7BBF38F630DF17C0C7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E332.tmp

Path C:\Users\Admin\AppData\Local\Temp\E332.tmp
Size 468KB
SHA256 d6f0b90a3e2cfaa1336f06db765c3c03e64fbcf43d7a329e21dd82515582255e
MD5 a45cc42e02f5028ebe1d1cfa33b54e75
SHA1 654fd654a38f15c8bdeb98a573fab2b394839f76
SHA512 142cabfc183d76048a12bdc148cc173fce7a3a840bb951624482670fe5ce07332551cf3553d19de7157ee3916188e716e48f716ebd3dba1dd7eee12cc81b6e99
SSDEEP 12288:qO4rfItL8HGtUUoglIyf8p0noOsHhlc7bWmeEVGL:qO4rQtGGtg/yf88oOsMumeEVGL
TLSH
T103A4F13AB241C133D29302740BE6EBAAA63E75754326A4C377D8027D6F616E1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download