c93285663035da881e8a028a8e3969e8946bd98ed0bcc8cdd42714b682b4f003

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 11:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_4639dbc45f9e46a835e675ac87fb36e9_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260723-m7tfmscb89
SHA256 c93285663035da881e8a028a8e3969e8946bd98ed0bcc8cdd42714b682b4f003
MD5 4639dbc45f9e46a835e675ac87fb36e9
SHA1 dbd2446bd03b9226d48225e8a5af6c2bac57148a
SHA512 0485e9e058dc4f5aa3a327d2cacb8f7de360a1d9db039df6cd9ff4aea7c2be95e691ffc23c3c3720b79b2d27a9bd4d6b4a5bd75ed9a9a9f9c374e79121b0999d
SSDEEP 12288:Z594+AcL4tBekiuKzErhbzTbOQeHJeHkUW60kDVYJl:BL4tBekiuVrhbzTiQgJeEU9YJ
TLSH
T1C294F1217581C037E29716354BF2CB762A7E7AA50B2AA4C73BC44BB81FA46D1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4960	3743.tmp

Executes dropped EXE 1 IoCs

pid	Process
4960	3743.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_4639dbc45f9e46a835e675ac87fb36e9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3743.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1196 wrote to memory of 4960	1196	2026-07-23_4639dbc45f9e46a835e675ac87fb36e9_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_4639dbc45f9e46a835e675ac87fb36e9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_4639dbc45f9e46a835e675ac87fb36e9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1196
- C:\Users\Admin\AppData\Local\Temp\3743.tmp
  "C:\Users\Admin\AppData\Local\Temp\3743.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-23_4639dbc45f9e46a835e675ac87fb36e9_elex_mafia_stealc_tofsee.exe 8DBCC9B0F3AFC4ACC74B74F26D644B59F545B86256CF0C02CFC38453FCD00A055672E51971E5627B178C39B674AFD094CE40854CCAF6B9E3CDDBCDD3B7DE775C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4960

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3743.tmp

Path C:\Users\Admin\AppData\Local\Temp\3743.tmp
Size 428KB
SHA256 90cc87633bc11291328b202ffaf2c1093dce07e31b87d1603729cbc034362c14
MD5 c7c520dd6a372ae60e3c68db13377571
SHA1 b7710777b689d4e369b783dbe2af4fc22b4bb51e
SHA512 30862f8f9d2b0e4c1ad82d41ba23afdc255c18fd86b9403ecb2b8344dc5bef9ec759a8b29953fd1b8c9737fdb41881facb9b472d93008dcbd93cee0f68bb8955
SSDEEP 12288:Z594+AcL4tBekiuKzEr7RVjANzpvHg+MWln3cnl:BL4tBekiuVr7RVMNVuWln3cn
TLSH
T1EF94F1323981C037D2A616384FE5C725597EB6B60B26A8CB3BD40B7A2EA53D1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download