16c96b93e17eff7e9663d0e033c3fa72c15452b263392bcb3e918a20e885d2ed

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_c27840768e0257b9de9a7bf6aa1cba49_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260722-vmbdbsdl71
SHA256 16c96b93e17eff7e9663d0e033c3fa72c15452b263392bcb3e918a20e885d2ed
MD5 c27840768e0257b9de9a7bf6aa1cba49
SHA1 112806a5316054a68a625dd6c1cc6873e306e387
SHA512 0a3b3470e621ea1abcd1f10a71bbe89f275f39f72ff3209a2494f5019165f2328d34259e019184fee03b0749257b947affab87651d271e829b9bc1042b74a08f
SSDEEP 12288:Wq4w/ekieZgU68Sh7KTiOB7H0SGxi3Llx:Wq4w/ekieH6LKVB7HhGxi3Lr
TLSH
T1E294E0217686C036E6A702344AF4CB696A3E7D714B76A4C73BD41BEE6E702D1E734306
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3348	9CA4.tmp

Executes dropped EXE 1 IoCs

pid	Process
3348	9CA4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_c27840768e0257b9de9a7bf6aa1cba49_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9CA4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1352 wrote to memory of 3348	1352	2026-07-22_c27840768e0257b9de9a7bf6aa1cba49_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-22_c27840768e0257b9de9a7bf6aa1cba49_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_c27840768e0257b9de9a7bf6aa1cba49_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Users\Admin\AppData\Local\Temp\9CA4.tmp
  "C:\Users\Admin\AppData\Local\Temp\9CA4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-22_c27840768e0257b9de9a7bf6aa1cba49_elex_mafia_stealc_tofsee.exe 2606182D344F443FA50F8CA6D3B762098B5AF0FFFFA22AE5F4287384888FD92DBCFAB36F0662BF1FD57323A111F6E111109423D59C33A13FEE0023D91187AEB7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9CA4.tmp

Path C:\Users\Admin\AppData\Local\Temp\9CA4.tmp
Size 414KB
SHA256 f637c1028c3598cb9b73fecbc4f0772fced5e3782195fe48469ee6089b6b33e5
MD5 ee47a26e1ee4a936364333dfe8da2dea
SHA1 656b72d5bca5e94794972ab3a538c5297e18905e
SHA512 65d7df2df07709b820ca7b866b0522ee89c4b4ae03a3a2b34aed61b96e8fa8d071c09aedcfaa06afd109115eb23761ca9311c730875c83666198c888a7e301d1
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYc2qjucKGjYomu68o8PtGeLHbxDA8899aG3lx:Wq4w/ekieZgU6D2BcKGZm3eJZAxsG3lx
TLSH
T13694E0217996C037E2A705394AE5CB7A593A7D640B35A8C73BC42BAE6FB12C1D730347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download