b1c7a5f1ef6657e14c73dd4e7c3f6a1aa74cde2c63669f45f88fe287b35d8295

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260720-wp8bhsct7v
SHA256 b1c7a5f1ef6657e14c73dd4e7c3f6a1aa74cde2c63669f45f88fe287b35d8295
MD5 194b5c6125809857c5cdb7d19501692c
SHA1 093fc19a2da0d3185f4af8b028e8822f36cc2d3a
SHA512 6beb55c5a1f7b4f8b7adacf81393a2bb11301b90872cbd6387a367c2bfb15065002cae6333489f06c276eab5242d4aa3b04d6ba9e7184f0f54d359fd6a5b92e1
SSDEEP 12288:Nb4bZudi79LoBLtrtGIT1susZNhnYTxUJ5rtA:Nb4bcdkLo/4IT1suaTE
TLSH
T159A4F1203581C037D5A301398FE6CB756A7E39A04B2668C73BE46BBD6EB02E1D635357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2716	5DC6.tmp

Executes dropped EXE 1 IoCs

pid	Process
2716	5DC6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5DC6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2716	2692	2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\5DC6.tmp
  "C:\Users\Admin\AppData\Local\Temp\5DC6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_194b5c6125809857c5cdb7d19501692c_elex_mafia_stealc_tofsee.exe 087EE5F2DE516129BF49B5041A5E8F1FB48A75752C5881FB3F00F9FC65E9C2C21456D8469BA9E8E8112D418D73A9F1308A9B105EEC0C43E2947B850ABA6149CA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5DC6.tmp

Path C:\Users\Admin\AppData\Local\Temp\5DC6.tmp
Size 444KB
SHA256 9d69ea24767f1376ed989d5c1fbf114d59b12a49900759b86ee553e147d6fe3c
MD5 6944be1a459343d0c8b9abe9b508ea88
SHA1 3d11e2bccd986bfd98f1af62d30e8a4f11fb87ea
SHA512 cf032abf904a421a962817422badf3aeeca72631c1de5c3782037f9bd24c647648b43fce79f308c578a364c75f1fe616bac1b6b2f2aec1a081ae88f8277dce3f
SSDEEP 12288:Nb4bZudi79LEdMKXyw1BlK7x0RRGO0/VP8oq/vA:Nb4bcdkLEGC91PwUB0/VEoq
TLSH
T1D8A4E1243542C037D29715344BEADB36653E3AA14B36A8CB37E01BAE6E712E2D735353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download