710f42f1d04c4a2cb9e1719eca6530a8579b86a92f88f02235572b2c26da0842

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 01:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_acaab7c6060464882928fd2aa1715ae7_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260721-bmbvbacx81
SHA256 710f42f1d04c4a2cb9e1719eca6530a8579b86a92f88f02235572b2c26da0842
MD5 acaab7c6060464882928fd2aa1715ae7
SHA1 9e55402cf60788e015052ead6f6d1cd22fcd11fd
SHA512 80d8c53dea80b0d9e76328c5713d86ffa23d5c6423087153d66bd7cd073e5cb4de8d44a6b2e5e9c11b57ba0a535677b1c0df56996622bfd60ca1466f4d0770fc
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYh3Gn16pJ5ynm4vbXKfRleAw9J:fd4x+ePixnXQjvn8pYmuKfyAwP
TLSH
T1A094E0203686C03BE1A705348BE5CBAA59797D755B32A4C33BD42AAE6F742D1D73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4224	CFF8.tmp

Executes dropped EXE 1 IoCs

pid	Process
4224	CFF8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CFF8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_acaab7c6060464882928fd2aa1715ae7_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 4224	2720	2026-07-21_acaab7c6060464882928fd2aa1715ae7_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-21_acaab7c6060464882928fd2aa1715ae7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_acaab7c6060464882928fd2aa1715ae7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\CFF8.tmp
  "C:\Users\Admin\AppData\Local\Temp\CFF8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_acaab7c6060464882928fd2aa1715ae7_elex_mafia_stealc_tofsee.exe 0453392AC4A15307C485935A3E8D98BDD60949E4A108EA3011935883CB2E5F67EB2D04FA41D32F8B8313975EE00D00DF993431BC627946F5F63706C85BC953C3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CFF8.tmp

Path C:\Users\Admin\AppData\Local\Temp\CFF8.tmp
Size 435KB
SHA256 a003ec83a413825d1a925a969c8ddf5fd64aba0a7f675bbcce987f1c96fd8a1e
MD5 508dc5630fe2267bb86215dfab2cf26a
SHA1 823a104532e0e5f42bff297bd66e7df78ed18691
SHA512 dd939867e8f8ce637d2858a0f5aa1a1498aac95215e617a26185125e71babd87317da4bbbe4cbafde2274554ffbcf8f06f528a3dce82a126db82be62df91aa9c
SSDEEP 12288:fd4x+ePixnXQj87FQN+cGI+CAS48sb2hkVnnwP:fd4x+ePixAjKb2ZhU2hkn
TLSH
T19D94E0253586C036E1A606388BE1CBB9693E7D604736A4C77BC42BAE9F742D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download