58f77d1a3fdfc26da88da6eb1f208df120e6d31e22f3687f28a1ad095af5cdb3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 17:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_a6dd71e7dc212d1136b24ce7fc000262_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260722-vt8meazdlb
SHA256 58f77d1a3fdfc26da88da6eb1f208df120e6d31e22f3687f28a1ad095af5cdb3
MD5 a6dd71e7dc212d1136b24ce7fc000262
SHA1 172dcf14a1354471d7e2ba066d41054df1ed5e81
SHA512 f6f4c4e7305b6755c44c8b29a73368c5f75810be277197085104ba0ede04aa5d1735ac022b6dcefc3e89109567f557a60d9c4c1d9746c263b8b07b8909ee1773
SSDEEP 12288:Wq4w/ekieZgU6VXmQTrQgdIKNAfIzAxjrPdlx:Wq4w/ekieH6BmQgguKcIzAZ1r
TLSH
T18E94E0217696C036E29706348BE5CBBA59397DB04B31A8CB37D02BAD6E742D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2764	AF80.tmp

Executes dropped EXE 1 IoCs

pid	Process
2764	AF80.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	AF80.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_a6dd71e7dc212d1136b24ce7fc000262_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1372 wrote to memory of 2764	1372	2026-07-22_a6dd71e7dc212d1136b24ce7fc000262_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-22_a6dd71e7dc212d1136b24ce7fc000262_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_a6dd71e7dc212d1136b24ce7fc000262_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1372
- C:\Users\Admin\AppData\Local\Temp\AF80.tmp
  "C:\Users\Admin\AppData\Local\Temp\AF80.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-22_a6dd71e7dc212d1136b24ce7fc000262_elex_mafia_stealc_tofsee.exe BDE1604143C2B22BFC263A87A7D6E185E51F64E5989FBD10E0DB2258BDC72024B70517D38893FE0AC0DAF7312D3D87D3C7DAC1984BE8A11450B83F28B6EEF3A2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AF80.tmp

Path C:\Users\Admin\AppData\Local\Temp\AF80.tmp
Size 414KB
SHA256 cf69280e778b9e085f0cb8ae57976de09df557c8b4fb1f368a97eda4203f290c
MD5 0df696ccb8bc873d43cc0ad163a60a4f
SHA1 ad9e06c01e5251c541ff48420c5eae9f09106a17
SHA512 27aa877d202699b7c7756e4ebbd335a09caae637f478fe45d640ae75c6d4f05d1fcce0f4e3cfc3781c0d6d0629e2d7a6c3daf2afdddcc173978b771fa8e1fb59
SSDEEP 12288:Wq4w/ekieZgU6SAzYliJo1A7wBpbV7NPzS4ii4ilx:Wq4w/ekieH6SAzna1fBnS4i9ir
TLSH
T1D994E0253186C037E1A706784AE5DBA66A3E7DB50B36A8C73BD02BAE5E341D1D734343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download