2f224b43cebc6399bfb07a0e662dc83c2b119b4b2f6b36bd487515b6269135af

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 19:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_382092297cd73f99482932c7d3d3d911_elex_mafia_stealc_tofsee.exe
Size 499KB
Sample260720-ybtmbaez4x
SHA256 2f224b43cebc6399bfb07a0e662dc83c2b119b4b2f6b36bd487515b6269135af
MD5 382092297cd73f99482932c7d3d3d911
SHA1 c498aa98eb662d760e7550510c3534cab4be15fe
SHA512 64b8664261554288913aec5aa582db8cf96eb01a85e191a31d823e9c76668e96103f87f7f361f891831373b0e27aa4d0dae2636f8909011057940405471d09b8
SSDEEP 12288:sO4rfItL8HPSj2wBWm53MQFN+hVq9I/7dmsIhiqlj:sO4rQtGPSjlF5hweI/AsIhiqlj
TLSH
T129B4F12672428133D2C201711BEADBAAB63F7975173AA4C33BD4427D2F616E1D739386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1640	6A78.tmp

Executes dropped EXE 1 IoCs

pid	Process
1640	6A78.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_382092297cd73f99482932c7d3d3d911_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A78.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4148 wrote to memory of 1640	4148	2026-07-20_382092297cd73f99482932c7d3d3d911_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_382092297cd73f99482932c7d3d3d911_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_382092297cd73f99482932c7d3d3d911_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4148
- C:\Users\Admin\AppData\Local\Temp\6A78.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A78.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_382092297cd73f99482932c7d3d3d911_elex_mafia_stealc_tofsee.exe 58CCF0684EB1F42B8C07831749D81456B4BCB22C5B035D6F83592E64007C1D319195AFCC941B57F7CA2027C02E5F50EC24842669D6D2DB6F3AAA65A57F34EC32
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1640

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6A78.tmp

Path C:\Users\Admin\AppData\Local\Temp\6A78.tmp
Size 499KB
SHA256 a39d72d3c0b1bafa4529a2244455f0fe3c0f359137a47ef0345b8a96c4f4a8e4
MD5 0ce35df5e096fdbfabe2a0b8969c8e9b
SHA1 99d4398cbe5fe616a851d4dfaf8d44ae627d8ccf
SHA512 9f0065bb66cc4e4175f2afc40732b9bd96141c7f5b4712daa6e5fed6b47394bc58e7e4987c5e9a0ab6d5abf412b368712984307eff06f6d1c13a1dbd74e0484d
SSDEEP 12288:sO4rfItL8HPAXp8zd8sraUeasKa7FJ5O4+7dmsIhiqlj:sO4rQtGPA7srZeRFjOtAsIhiqlj
TLSH
T176B4F13A7281C133D29302711BEAEBA5BA3E3975136654C337D4023D1F66AE2D77634A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download