0a10d2a909fb4ef8fb7afccef45649972ff94797d0dd5cbbde9f97a7325b8d4d

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
22/07/2026, 19:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-22_1845263b8373d467314e10bc85c99b77_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260722-ynapzaztes
SHA256 0a10d2a909fb4ef8fb7afccef45649972ff94797d0dd5cbbde9f97a7325b8d4d
MD5 1845263b8373d467314e10bc85c99b77
SHA1 d5cc3695b0bda8c836ca904e2b409a8bb4952998
SHA512 670dcaab4d0bcbbcf2d969c70b17696599f99928d54bb4fc14c47612fed222e87041d1e8a302dcf4b0a76aff0ddfe670fcb917847613965d9d62ab0d906d121b
SSDEEP 12288:qO4rfItL8HG1KhsDZUGMQoKZWjiGR7bWmeEVGL:qO4rQtGG1ys4Q9ZWfumeEVGL
TLSH
T1B5A4E12A71428133D29306750BE6D7AAAA3F79B5172A94C33BD0027E2E657D1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6004	1831.tmp

Executes dropped EXE 1 IoCs

pid	Process
6004	1831.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-22_1845263b8373d467314e10bc85c99b77_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1831.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 6004	2960	2026-07-22_1845263b8373d467314e10bc85c99b77_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-22_1845263b8373d467314e10bc85c99b77_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-22_1845263b8373d467314e10bc85c99b77_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\1831.tmp
  "C:\Users\Admin\AppData\Local\Temp\1831.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-22_1845263b8373d467314e10bc85c99b77_elex_mafia_stealc_tofsee.exe F6881B7189F1B9E901FDA87BC16EA512BDD384AB319C46F6FEEC4A7AAA1D2142FE9B9B457F416A5B72A22E8DF924D8B25BC3F960EBF14A68EDA60A92826BF75B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6004

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1831.tmp

Path C:\Users\Admin\AppData\Local\Temp\1831.tmp
Size 468KB
SHA256 38a4b0156d07ffce0c5982d5fad1aeb4fdfbac3377d2e19fe03fb2c9a13573e4
MD5 f660468d744525103e7811baa5e7103a
SHA1 08f76fbbd2de4d74897eb5538969654f0b9c145d
SHA512 0774f037dfb07fa3756f91ffec349fd42efdb3cda460312560be86f929a898f17cc246784c9f37bb47b5a72737daa5fb30fd53bd36d7c718cde227d91b85286a
SSDEEP 12288:qO4rfItL8HGFzcRTRW6LsD2qN5qlQ7bWmeEVGL:qO4rQtGGGfW6YpbumeEVGL
TLSH
T167A4F1397641C133D29302751BEADB6ABA3E75B44726A4C36BC8027D1FA16E1D33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download