bf088f585432dffb8d23e43747145b04f4b15323bfae4854744a581480dab760

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_d6f3fcf4339ce283cfcb5c04f15911e9_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260722-xtvrnafn8t
SHA256 bf088f585432dffb8d23e43747145b04f4b15323bfae4854744a581480dab760
MD5 d6f3fcf4339ce283cfcb5c04f15911e9
SHA1 610a30a891e42e8bcea05c78819f1e4c0eb50d7e
SHA512 14d37ca1dd016092c622ce59ee6400509c277d2d6ce4a663287add9d013a1855c4af8c89ebda6b152b92b665a363dd1d60f8d9d36c55d46503377c94bb4d8342
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iSt075bh/H2cZocu/tGuTq53l7I+G5/9SA:Nb4bZudi79L17dh/WtXFGll7PA
TLSH
T1B2A4F1243182C037E2A715354BFACB75653E7AA14B2278C73BD01BAE5EB02E2D635357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1328	F1CD.tmp

Executes dropped EXE 1 IoCs

pid	Process
1328	F1CD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_d6f3fcf4339ce283cfcb5c04f15911e9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F1CD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 1328	4132	2026-07-22_d6f3fcf4339ce283cfcb5c04f15911e9_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-22_d6f3fcf4339ce283cfcb5c04f15911e9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_d6f3fcf4339ce283cfcb5c04f15911e9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\F1CD.tmp
  "C:\Users\Admin\AppData\Local\Temp\F1CD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-22_d6f3fcf4339ce283cfcb5c04f15911e9_elex_mafia_stealc_tofsee.exe 1CF5020F97BEE5A0B5BF8173E644FCEDB01AAFBA374F6B6A6CE35BA860A120E546DE28FFCBB8CBC09E009B6DB7D5F2D83C6C603C3CC7C3BDBAE2EAFFD311C73C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1328

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F1CD.tmp

Path C:\Users\Admin\AppData\Local\Temp\F1CD.tmp
Size 444KB
SHA256 da78af01f4c609f8d34c3b627c598cfe33acb65756e3b90fec4a53263226ada3
MD5 293410d218c7bcb389ab6cc8a9cda293
SHA1 fc2111b864742ba4dbeac2d1012dbe2423830b34
SHA512 39dd5cb53094aea5f2086fecf9ea4e16573bed369f50f877c2e4de0e5c06638adb5cfc4a5217f171540d6f2f562f7e02695d50b84d5116df74156678d2ddb35d
SSDEEP 12288:Nb4bZudi79LcAOcTxo3aVUZkTxJOMdhmv2TxA:Nb4bcdkLV1o3aOi3/qv
TLSH
T1D4A4E0243A82C037E29711344BE6C766653E7DB15B2668CB3BD41BAE2EB42D2D730357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download