e09a34de3ca181946721c6d50d64a21591b46c33f5975ed160782ca6fc503c46

Analysis

max time kernel
148s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 17:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_50a9ac426fdf7d5e381da710e2117810_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260721-vx4gvs1fph
SHA256 e09a34de3ca181946721c6d50d64a21591b46c33f5975ed160782ca6fc503c46
MD5 50a9ac426fdf7d5e381da710e2117810
SHA1 92cb70ddd95a0c410c8f6e963ef6a6557225177f
SHA512 833a39ce867ab6f8e9532d2812562c5d22c13f389d03a072f3487a7be5533f3f54b5aec92a205bcff8f6543724ab1c445504568413cd5fbb1e8fa74f593cca8c
SSDEEP 12288:Nb4bZudi79LD4m9ln1w1XLXssDgEnTrau3SV6uN4FA0a:Nb4bcdkLDQLcsD/nHEDS0
TLSH
T198A4E1243181C037E29706348AE5C7B6663D7DA18F61A9CB3BD477AD6EB02E1DA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1836	6B62.tmp

Executes dropped EXE 1 IoCs

pid	Process
1836	6B62.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_50a9ac426fdf7d5e381da710e2117810_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6B62.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 1836	1004	2026-07-21_50a9ac426fdf7d5e381da710e2117810_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_50a9ac426fdf7d5e381da710e2117810_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_50a9ac426fdf7d5e381da710e2117810_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\6B62.tmp
  "C:\Users\Admin\AppData\Local\Temp\6B62.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_50a9ac426fdf7d5e381da710e2117810_elex_mafia_stealc_tofsee.exe 83A3C3E13F71C1C66EEBF1C178111950EFFE8C6D83A866DECEAB3A919842661D06FEAF9409E645DF0D305361A14174938B001202C473947F7906A43609693BAD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1836

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6B62.tmp

Path C:\Users\Admin\AppData\Local\Temp\6B62.tmp
Size 473KB
SHA256 6f0cc844b0327106e2289f799560155e9beb03ad64411b4ce3fe283a4fd374f7
MD5 1180b54e8a56e06ec42498e0d9e02083
SHA1 b472d2d4db6e841dfbd07e64a0b12964e3236476
SHA512 9cff8fa5c3cae71a297ddfc8dadfe93781fe0c367d0759be32d31c89ed05e5e2f786c9750b85a8b2754e1eb0140c2950e3984384d880de29c7923f7164b5af3c
SSDEEP 12288:Nb4bZudi79Ljb/+/RcGGYS5GTN2kjeaTwA0a:Nb4bcdkLH+qrqMefj
TLSH
T125A4E1217591C03BE29706340AE2CBB6667E7DA15F3168CB3B947B6D6EB02D1E634307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download