410b8223943246d88db5be6169bb7ec4ba49373c50f83228ce0fec910927209a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_92641c87bcf9451fe74b5c15311ea24c_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260721-sdjbgadm3x
SHA256 410b8223943246d88db5be6169bb7ec4ba49373c50f83228ce0fec910927209a
MD5 92641c87bcf9451fe74b5c15311ea24c
SHA1 c7c6d479328953e2812aef408138e52fdf31d0a1
SHA512 7560c40f2ebdb72b6e5a3a9c53f419b8534e420251e30d76aaed70e00f713d37255049ded0179624ea529aa4166c9ee5e39c659000ff58798f797780b4b07d97
SSDEEP 12288:aO4rfItL8HR4m/OmLKeu4j0oD/PD5LlMou7L27K9wlsDpVFd:aO4rQtGRH2ax0e/FsH2+9wlsDpVFd
TLSH
T177A4F12A76818133D29301741BEBD7A6A73E79B41375A4C37BE4026D2F61AE0E736347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5720	B8A8.tmp

Executes dropped EXE 1 IoCs

pid	Process
5720	B8A8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_92641c87bcf9451fe74b5c15311ea24c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B8A8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 5720	2608	2026-07-21_92641c87bcf9451fe74b5c15311ea24c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_92641c87bcf9451fe74b5c15311ea24c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_92641c87bcf9451fe74b5c15311ea24c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\B8A8.tmp
  "C:\Users\Admin\AppData\Local\Temp\B8A8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_92641c87bcf9451fe74b5c15311ea24c_elex_mafia_stealc_tofsee.exe 37D2B3BD276A22C8B1B3A86283EA884A80F5FE92E0845422305E01DCDA0A265ECD850BCE7146578558901EFE75F298B4740D7416C45FD22188F121B16D78F5D2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B8A8.tmp

Path C:\Users\Admin\AppData\Local\Temp\B8A8.tmp
Size 476KB
SHA256 27f200f9640c79264d4f6a4410aa5595849c52b095e97184ba4417372b4b84f4
MD5 9cc1a364f757313988bafb905e6e0f90
SHA1 69ee5949030976114f47be8e15875d275c683b12
SHA512 7632fed6e883c0789fed900230505acbf2688b46ba213e44552f40204ed660fc3dcc146bfc56c9fb9366440aa926a3ddb1a83651e069fe981eddd72d3ecd95f7
SSDEEP 12288:aO4rfItL8HRGaLNvgfIxQ/Fr4c+b7K9wlsDpVFd:aO4rQtGRTvaW+9wlsDpVFd
TLSH
T199A4F12A7681C133D29302751FD7DBEAA63E79741726A4C33BA4032D2F616E1D73A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download