c94b072a9b50ac655b0f495fabc043ffa90d7bf6f9b4ae56adbd070df15f783f

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 14:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_b3a144ebc69b43487b9caf4fa24d22ab_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260721-r5vm5sbb64
SHA256 c94b072a9b50ac655b0f495fabc043ffa90d7bf6f9b4ae56adbd070df15f783f
MD5 b3a144ebc69b43487b9caf4fa24d22ab
SHA1 fd06bb21273f4a7b4c60bd07ee4e85f8e6e1a992
SHA512 86f0ed429e92d7a5bba6c7a2d216a7718cb6ceb9b5992c7d39aecd9b9c7cf6ebdc42ed1f19a7a3a31b7a29e273152bab500a6f6a6927e5563e22820b0f98df12
SSDEEP 12288:fd4x+ePixnXQjA1u+QbjOP1mzz61nnZcv5YwP:fd4x+ePixAjCOOPgzz8nZchY
TLSH
T15C94E0213686C037E2A715344BE5CBA9593A7D654B3268C737C02BAE6F742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2632	2764.tmp

Executes dropped EXE 1 IoCs

pid	Process
2632	2764.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2764.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_b3a144ebc69b43487b9caf4fa24d22ab_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 2632	2236	2026-07-21_b3a144ebc69b43487b9caf4fa24d22ab_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_b3a144ebc69b43487b9caf4fa24d22ab_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_b3a144ebc69b43487b9caf4fa24d22ab_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2236
- C:\Users\Admin\AppData\Local\Temp\2764.tmp
  "C:\Users\Admin\AppData\Local\Temp\2764.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_b3a144ebc69b43487b9caf4fa24d22ab_elex_mafia_stealc_tofsee.exe 8B59933B5F220D8A2AE38BA5F96FD7642E89B013EB9A523FDCFD0730A04CFE42C1B1DFEE454A2F850043C9A5D22E9AE20A0FC2B6EFF0BBB0C55FEA136778F3A4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2764.tmp

Path C:\Users\Admin\AppData\Local\Temp\2764.tmp
Size 435KB
SHA256 7b8c35bb1240ea8479ab40cebddc2d3d82431e4393386cd9f970ea130b2b3ae1
MD5 5cf0e2e552189036ef84e509b834bda7
SHA1 14d1414bae4bf982e448e3bfa8dd8de0d2b14026
SHA512 17f45243d9a2440fe217aebba6af2f8356e9eae12829ea0f2165de69ea38120a12ab90b69b1b9c67b23d3070725c543399de357d6a532d97445a8adad01f5d0c
SSDEEP 12288:fd4x+ePixnXQjRa60QzPKtLhWgIdNUUURwP:fd4x+ePixAjRnZmx6NUUe
TLSH
T18D94E0213586C03BE1A615384BE5CAA9593A7DA14B32B8C737C42BBE6F706D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download