93eed09880000c7d9a3395d502cfd3acd0746d801ada2bb630b104563e882bf8

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_5bfa374490f8c79527ede719c68c4204_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260721-vveeysda35
SHA256 93eed09880000c7d9a3395d502cfd3acd0746d801ada2bb630b104563e882bf8
MD5 5bfa374490f8c79527ede719c68c4204
SHA1 7b26da225c6fc1ebc7a8f5188521aa65c5ba2fa7
SHA512 6f29db844f6ddcb20180eb47c567edd5916ce73606b4b44d99d8bcacc936857d33071fdc6d592a20c6d7be3d5c00c7827820f340fe9e2754d0f29afcd9cf4795
SSDEEP 12288:bO4rfItL8HAoawe7w6C549pq7kARqPlDmbqsT75UO:bO4rQtGAK8wgpt5PlDmdVUO
TLSH
T19EA4F12A76418133E39302351FE6D79AA73A79740725A4C73B98026D2F71AF2D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3076	791E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3076	791E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_5bfa374490f8c79527ede719c68c4204_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	791E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5732 wrote to memory of 3076	5732	2026-07-21_5bfa374490f8c79527ede719c68c4204_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-21_5bfa374490f8c79527ede719c68c4204_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_5bfa374490f8c79527ede719c68c4204_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5732
- C:\Users\Admin\AppData\Local\Temp\791E.tmp
  "C:\Users\Admin\AppData\Local\Temp\791E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_5bfa374490f8c79527ede719c68c4204_elex_mafia_stealc_tofsee.exe 570BE39FDB0439E15F207DEE39BA46997169B4B722B14A772D71C87F565A6EA4764B3963702F82A274AE26AB1DD0C6272E4AB973909EFEDC6F730FED6ED49F47
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

791E.tmp

Path C:\Users\Admin\AppData\Local\Temp\791E.tmp
Size 479KB
SHA256 fec34c47352d5792c61f20b6c10ad66959466ea59fa0fcb3f951eeec7af9101d
MD5 faa7005d58b3c88260acfd82abc7f914
SHA1 7842ed90f463b03e1041d79f7bc6467bf2fb1c7e
SHA512 fa285509a6f82fc848f1af9e46a9f54d69b06e9cbd37b92921055e363befdc0364047509a442f2be6f83389dac24c88db9273f8c27a194aa24513171664de5d0
SSDEEP 6144:b9EyS4oMxIkjxcWqHtg88HARROtW3yiT/NMWHUzPbp06HYzRXa22YQ7f06EHZgMR:bO4rfItL8HAryeNVUzYTJBd75UO
TLSH
T193A4F12A76818133D29301350BE6DBAAAB3A39710726E4C737D8077D1F656E1D37638B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download