0343df723ea9c8f054d7d5487b8c28dc6cfe5aeffe735df0c795f4d3aeef888c

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_b030422764902cf1ff262ad26d5f6f6a_elex_mafia_stealc_tofsee.exe
Size 613KB
Sample260720-vn6kvsay41
SHA256 0343df723ea9c8f054d7d5487b8c28dc6cfe5aeffe735df0c795f4d3aeef888c
MD5 b030422764902cf1ff262ad26d5f6f6a
SHA1 f735f962a693ff615afb5f331980aab44f88737a
SHA512 c82b424e9d8c8c57c56eb380e0585d22a91769f9341dad6e49e5a75ce4ab405bf09bad4497802f0cbfd14894564d9ed4a08657331e01560c14825be44f234cb9
SSDEEP 12288:XO4rfItL8HPpZmR7iIgOsbf67Q8mO4rfIt+2:XO4rQtGPKWIQydmO4rQt+2
TLSH
T1DCD4E1257340C037D5A612395BE7EB6A663A7E74071265C33B902B7D2EB02E2D73934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4296	594.tmp

Executes dropped EXE 1 IoCs

pid	Process
4296	594.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_b030422764902cf1ff262ad26d5f6f6a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	594.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3472 wrote to memory of 4296	3472	2026-07-20_b030422764902cf1ff262ad26d5f6f6a_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_b030422764902cf1ff262ad26d5f6f6a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_b030422764902cf1ff262ad26d5f6f6a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3472
- C:\Users\Admin\AppData\Local\Temp\594.tmp
  "C:\Users\Admin\AppData\Local\Temp\594.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_b030422764902cf1ff262ad26d5f6f6a_elex_mafia_stealc_tofsee.exe 68AEC07FECE3F13C262C5DECB7DEF07CD79F938E0B0277FE227814A5585B8B97F99D77F2D51CF09D7F8B9E423F872EA73A0B992D42CDB55B84704EF7725DDCED
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

594.tmp

Path C:\Users\Admin\AppData\Local\Temp\594.tmp
Size 613KB
SHA256 7028913d2647c05c2cb477b048d998bbfe34d253ac4816f7038c6845ed3b0610
MD5 d999fda7ade66b47cf7f09e0ea4cbad6
SHA1 9fadbd63938a71fb0d020d0d8db0d9276e193695
SHA512 ea2d7ccb4212825923e8103a1192b796e76fbbc8b2a2de42464f3d8cbc1e21ea50d246eaac01591dfced4926be4473a1e30ddc45d90aba19d9230dca5d0ec813
SSDEEP 12288:XO4rfItL8HPXZxf4hRV/l37BgR4cJKw67Q8mO4rfIt+2:XO4rQtGPMenJodmO4rQt+2
TLSH
T1E8D4F125B780C037D5A111395BE3AB69667A7E700B12A5C33B94277D3EB02E2D73934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download