846135e51eaf9d741d2ff88460c72d31c8f663a83cdc0e912969e2d10e5f3c3a

Analysis

max time kernel
150s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 10:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_8e62e3a9106e360fef40400ef9742285_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260723-m1bl9aca72
SHA256 846135e51eaf9d741d2ff88460c72d31c8f663a83cdc0e912969e2d10e5f3c3a
MD5 8e62e3a9106e360fef40400ef9742285
SHA1 643988eda47ee5162605a01bd5c1ddaacd189170
SHA512 957343947baeef71e7e1726b5448640544cc8160abed42402ac655473661a25ee003898b5523f7419322b1e720e8ef24dc2876ab06da58831cec14392105ebb9
SSDEEP 12288:Z594+AcL4tBekiuKzErL9gwzW+aG8Jg45XVEpANxh2Q7H3vlvl:BL4tBekiuVrCwC+aPDgCxAUH3vp
TLSH
T1B894F1353582C037E2AB15344BE5CB66597EB9B14B25A4C77BC40BBD2EA02D2E73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1840	4ACB.tmp

Executes dropped EXE 1 IoCs

pid	Process
1840	4ACB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_8e62e3a9106e360fef40400ef9742285_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4ACB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 1840	3824	2026-07-23_8e62e3a9106e360fef40400ef9742285_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_8e62e3a9106e360fef40400ef9742285_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_8e62e3a9106e360fef40400ef9742285_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\4ACB.tmp
  "C:\Users\Admin\AppData\Local\Temp\4ACB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-23_8e62e3a9106e360fef40400ef9742285_elex_mafia_stealc_tofsee.exe D3418C0EF209042C9A5A2E1F408B17A584E3230ED90A93ADCEBD3C8278E9278C1D6CC9975B6F1C7D08961167FF808A673A0375856D3A307BBE9D9D3A8971454B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1840

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4ACB.tmp

Path C:\Users\Admin\AppData\Local\Temp\4ACB.tmp
Size 428KB
SHA256 76a97e3e3c735699e3dcf8430bf8d0155a3dabbc5ca66862c56ad3b617a7a0af
MD5 38fe068a5654ce25a889cc8eec810fa7
SHA1 facc95ffce26ac8ffbdf0d5e54ad3cc31760e5e6
SHA512 f91c3924b9581f7f15534efa5f4b03de855dd2803b707306e260dcf4a8fb8c290089ce8cdb8889d59219fbff14a2c77c308d759c139b98e7fbd460e6be130449
SSDEEP 12288:Z594+AcL4tBekiuKzErFg+KOuZfkeaGxdRM9u7f/pl:BL4tBekiuVrFg+Kd2Ge9mfx
TLSH
T1DC94F1353582C037D2AB15344FE1CB66167EB9A10B2268CB3BD41B7D6F646E1E63438B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download