1de8e57a2c546b42ad5d1261847ec4688d1be25a276c5bbe36f751f00c60505e

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_02ecaf660b5938a5039c81006bbf9c79_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260722-tem7gsvvdv
SHA256 1de8e57a2c546b42ad5d1261847ec4688d1be25a276c5bbe36f751f00c60505e
MD5 02ecaf660b5938a5039c81006bbf9c79
SHA1 a11e1359e44cf292feeb6fe07a617a4f9832bc2a
SHA512 35c79030cecd94f352f2c62cbffb6160f14a96dd340b15bbe5b1043afafd1541d40bebb97a121dee935b215dba5e967fcf04b4fd9432b6d61b15651d5175dbb0
SSDEEP 12288:Nb4bZudi79L5tZndR5zPFjmb2qkWtonLA0a:Nb4bcdkLz7z9zwonO
TLSH
T189A4E0213481C03BD2A701354AE6D7B5663E7DA19F2168CB3BD07BAD5EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2660	6A78.tmp

Executes dropped EXE 1 IoCs

pid	Process
2660	6A78.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_02ecaf660b5938a5039c81006bbf9c79_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6A78.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1004 wrote to memory of 2660	1004	2026-07-22_02ecaf660b5938a5039c81006bbf9c79_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_02ecaf660b5938a5039c81006bbf9c79_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_02ecaf660b5938a5039c81006bbf9c79_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1004
- C:\Users\Admin\AppData\Local\Temp\6A78.tmp
  "C:\Users\Admin\AppData\Local\Temp\6A78.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-22_02ecaf660b5938a5039c81006bbf9c79_elex_mafia_stealc_tofsee.exe 7980634124B8A133A3E9360A546032CD683AF1970643476A7B0BF8AFA87E9137D40D55826A84D3333AE0274549DEF4EF9F88FC1F864A550B9E57F903B7B8E85E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2660

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6A78.tmp

Path C:\Users\Admin\AppData\Local\Temp\6A78.tmp
Size 473KB
SHA256 fbc34347acc50a56d40de8176f941078496b401dd4e508303fe4cb3414c08c3c
MD5 5a7494342bc7f6a20c70a53e7b8e190e
SHA1 ae54752a844b7467fb93d864a44277c1e58e475e
SHA512 eda295a0b930a1df38773846a493d8934ca35b497f2736df5fc5522fef9ccc388fe287fe44d37cfffd7f936aba9c7b2eb6d58c44696989c4bca2fe2ed0cf8b24
SSDEEP 12288:Nb4bZudi79LJt+MWcjofEylERilqM/PA0a:Nb4bcdkLCMWrfvTqv
TLSH
T1CAA4E0213281C037E2A706344BE5C7BA553A7DB15F61A4C73B943B6E6EB02E1DA38357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download