6b7e0cd68769065e40434ce3cc88d46722646441a7341f1311bd230281007959

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 15:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_69d89ba05ff7bbf89af6ec0c63ef2ae4_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260721-slwxjayepa
SHA256 6b7e0cd68769065e40434ce3cc88d46722646441a7341f1311bd230281007959
MD5 69d89ba05ff7bbf89af6ec0c63ef2ae4
SHA1 b30e8dd492e87012d51615dc2bb16dfca1d21276
SHA512 979c9398fbd403de40af4338376d8a676ec1f000ffe10086d4d61c0f95438d96745539275598a354693fa56d55d429d366630e4c52e1e191678e079094969b68
SSDEEP 12288:Nb4bZudi79LxtpgNyak1u6hCt3JvQkIMaXCA:Nb4bcdkLxDgNb6hKJYkI
TLSH
T162A4F1243191C037D2A712348AE6DB76653E39A14B25A8C73BC45BBE2FB03E2D635357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4644	4869.tmp

Executes dropped EXE 1 IoCs

pid	Process
4644	4869.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4869.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_69d89ba05ff7bbf89af6ec0c63ef2ae4_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4896 wrote to memory of 4644	4896	2026-07-21_69d89ba05ff7bbf89af6ec0c63ef2ae4_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-21_69d89ba05ff7bbf89af6ec0c63ef2ae4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_69d89ba05ff7bbf89af6ec0c63ef2ae4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4896
- C:\Users\Admin\AppData\Local\Temp\4869.tmp
  "C:\Users\Admin\AppData\Local\Temp\4869.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_69d89ba05ff7bbf89af6ec0c63ef2ae4_elex_mafia_stealc_tofsee.exe 66BBD7211C837E779B8641EC94E4234B1FA34653D7A4A55926CD7A39FD2E1E853D5B667DD61320F19F98B5B4E8FEC46E13BF0115ABA293B779B1EE60CE792F63
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4644

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4869.tmp

Path C:\Users\Admin\AppData\Local\Temp\4869.tmp
Size 444KB
SHA256 7ea83ad707566669fe9e5d0380dcf0a963c3fbe7136806f3099ede9385886187
MD5 b09b6c6aed0604d052cf643ab5e13681
SHA1 c1ecfda1a4d233a57efc418c266a1d610d6346d1
SHA512 d8d06c4dd4be066e9c3e81c008d86bf7c910f60b16c06b7cc3f19cbcb9401b9d7fa98722ce14df8c3ee9d24b5219e7d0ba3804a6fab955cd46c56e8a67e1f8cf
SSDEEP 12288:Nb4bZudi79LcCueHcR9rJ3kExc/HC6JmeeA:Nb4bcdkLc7HR992fCeV
TLSH
T120A4E0243581C03BE2A302394AF5C776967E79A14B2578CB37C42B6D2FB42E2DA71357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download