3fa06d141f6031624f319ff613becb94da0f49dd387d56956afe97ae3ba99bcd

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 17:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_a16bbf41ecf5d459d169abf573bc3fbb_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260720-vr2q3shs3j
SHA256 3fa06d141f6031624f319ff613becb94da0f49dd387d56956afe97ae3ba99bcd
MD5 a16bbf41ecf5d459d169abf573bc3fbb
SHA1 3a38418ab969743a62317685cf57837632086a3e
SHA512 0bf697aa052a5d5efd037b3d2e2aa0e642c6025c25fa76e14b580412d8da734267528615e87e994a26c65c32d7c2918aa1bf0799d2006a3d24986a2f82599fd1
SSDEEP 12288:Nb4bZudi79LQ8a8ndqMpa/Lgsdbiuf4mrJA0a:Nb4bcdkLFxndqMpccKf4mrQ
TLSH
T128A4E0243141C037E2A706354AF6CBB6667A3CA15F6268D73BD03B6D2EB42E1DA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4420	E78C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4420	E78C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_a16bbf41ecf5d459d169abf573bc3fbb_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E78C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3956 wrote to memory of 4420	3956	2026-07-20_a16bbf41ecf5d459d169abf573bc3fbb_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_a16bbf41ecf5d459d169abf573bc3fbb_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_a16bbf41ecf5d459d169abf573bc3fbb_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3956
- C:\Users\Admin\AppData\Local\Temp\E78C.tmp
  "C:\Users\Admin\AppData\Local\Temp\E78C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_a16bbf41ecf5d459d169abf573bc3fbb_elex_mafia_stealc_tofsee.exe 0E51BEF4EB6069C3627596A6A85FF2008A0EF77448B76973D3340C974F1799104171651CADB490439B6CA6AE6D202A8A4B8D8FBAFE825DDAF89CCFE43524B7DE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E78C.tmp

Path C:\Users\Admin\AppData\Local\Temp\E78C.tmp
Size 473KB
SHA256 b320a76ef65e2e75037b5ab1e9e5fa9c3a7812d8e6537e07a8ef81e83aaf0e4d
MD5 e033bde39036e45a8ee4a96da685104a
SHA1 71535e6f0119e98e9f288917b5a6c27d65becb22
SHA512 761dd820b85911bcbf177e5aa6c167a4264b64c60c5d8141912f715af27e1690633b21ba94f14525f7bddde79753109a1dd99263b4427843422d05f3023c374e
SSDEEP 12288:Nb4bZudi79LZBkxmIC4CMk+TS5s/g68LDA0a:Nb4bcdkLZmAx4CM9W5+iLm
TLSH
T1D4A4E0207681C033E2A712354AE6C7F66A7E7CA15F6164C73B9037AE6EB12E1D634317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download