fdfb2ed0039a856c4a66111efcd06efcb0a3604bb3a8278c3031aeb94929d990

Analysis

max time kernel
150s
max time network
138s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_edfc90249a3168a3414fed86b156f463_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260720-xdwc9ab13l
SHA256 fdfb2ed0039a856c4a66111efcd06efcb0a3604bb3a8278c3031aeb94929d990
MD5 edfc90249a3168a3414fed86b156f463
SHA1 956dabb44730c484263efc171b1766c2182ab393
SHA512 bade71f84749159837fc5929a465750ba7ea6fcea49cc623349adaf10a1484523204288862e8e758762eb02bf1e4545fe9a1d4a56799c541cc2363aaf1848158
SSDEEP 12288:Wq4w/ekieZgU6pejP01nJIAUCXQLLS5tlMa:Wq4w/ekieH6ppJIwAijP
TLSH
T17AA4DF217186C036E29706348AE5CBBA193A7CA14F71A5C73BD037AE6E706D1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4784	8E2D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4784	8E2D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_edfc90249a3168a3414fed86b156f463_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8E2D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4664 wrote to memory of 4784	4664	2026-07-20_edfc90249a3168a3414fed86b156f463_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_edfc90249a3168a3414fed86b156f463_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_edfc90249a3168a3414fed86b156f463_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4664
- C:\Users\Admin\AppData\Local\Temp\8E2D.tmp
  "C:\Users\Admin\AppData\Local\Temp\8E2D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_edfc90249a3168a3414fed86b156f463_elex_mafia_stealc_tofsee.exe 2CA5002045B01FB89650CB48B7BBB9D6922972188530B7D2D39920EA8D74CAC4D652FAFFBD303A1F336393C4A0899BCC6CF49326DA68D09556FC368FC62B2E62
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8E2D.tmp

Path C:\Users\Admin\AppData\Local\Temp\8E2D.tmp
Size 443KB
SHA256 caf692548b6db51a8f0fcc374f8a166b95259af41846ea6020ba58f43d4b7c68
MD5 bb3660ac4c05bcc59fa597190755b5e4
SHA1 211ed7cd20f18f9f24e7349f9b38562127244aba
SHA512 4195b00d804b57a64a6eaa17fcbaa2eb1c32523ed35c4ac47dba155a2c2de23dad219fc32203c778865264c0da948989543347b327612b312b02b530e07d36c2
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BY/JO4iE8YaOALNx9fErDalSbZGzefwYZMABr93P:Wq4w/ekieZgU6PPYMRrXsYzeJZJlMa
TLSH
T171A4D0217582C036E2A306344AE5CBE9653A7D615F76A4CB3BD43BAE5E706D1CB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download