0249413ed702b9df939c5e14afbe8169307541d3cb0cecf230e434dd9660fa8e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 16:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_b20e803fd9bb0cc900b2ea3c1478b5d2_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260721-vaha4ser2v
SHA256 0249413ed702b9df939c5e14afbe8169307541d3cb0cecf230e434dd9660fa8e
MD5 b20e803fd9bb0cc900b2ea3c1478b5d2
SHA1 34f66ed5424390bb7edad48c8a356e083e6f7570
SHA512 bfe369a380ee879f0261f8931011120d57da2e36835bf014f2792b47048cd876f78c46b1e8f8b8bc9573bf75c66838c08cce048f1a60ecd89289dd0e955b5619
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvSmkIWjSaegH3yMql44gwaoCH+EkRWwjw1bG:Ci4g+yU+0pAiv+lWvPiMYWM/Z813w7
TLSH
T1AB94E0203552C033E2A715354FF5DBA96A7E34A24726B4CB3BD41B6A2E643E2E335347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2452	3AF.tmp

Executes dropped EXE 1 IoCs

pid	Process
2452	3AF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_b20e803fd9bb0cc900b2ea3c1478b5d2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3AF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3800 wrote to memory of 2452	3800	2026-07-21_b20e803fd9bb0cc900b2ea3c1478b5d2_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_b20e803fd9bb0cc900b2ea3c1478b5d2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_b20e803fd9bb0cc900b2ea3c1478b5d2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3800
- C:\Users\Admin\AppData\Local\Temp\3AF.tmp
  "C:\Users\Admin\AppData\Local\Temp\3AF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_b20e803fd9bb0cc900b2ea3c1478b5d2_elex_mafia_stealc_tofsee.exe D578DA4DD555752D5CE7AFD8DED6037C57627E3ED3ACC862C1BEE8422FC3A90796695139D5BE84ED1346D44DADDF1B2A6BA191909095C72BEF825D6D16D1A4EC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\3AF.tmp
Size 433KB
SHA256 84b9f86163cadb6858ac035c47ce29fcd74c556df05a387bf73381f7b5aa16ac
MD5 c1e5efcb5556960b9f7ab8e8e9781563
SHA1 d6171d7c93e4dcdcb4474293cd5ccf7a76cf676a
SHA512 2141de8cae94f72a555090c73f57523dbea7c049b4f4d378d5099bfd34455e96847907577ab8eb50e97cd6813bd6e4b9677c1327851643a03a7283611fdd9d1f
SSDEEP 12288:Ci4g+yU+0pAiv+upJ9ku2DZ5hW7PQ6ljUTd:Ci4gXn0pD+un9ku2DPMQ6K
TLSH
T1AB94E0313592C033D2A609394BF9CB6A667E3961072668CB3BD01BBE6F607D1D635347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download