1798c8ffabad360f00a4b10f3910aaeec747906d3d8e621cb5a7d066827c676b

Analysis

max time kernel
150s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 10:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_e30ce06f038e5d1cd4cceebbbdcfef6c_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260723-ms2hpsbh78
SHA256 1798c8ffabad360f00a4b10f3910aaeec747906d3d8e621cb5a7d066827c676b
MD5 e30ce06f038e5d1cd4cceebbbdcfef6c
SHA1 4fe62ebfb8964554ad1d7eb593d2e0716c16da45
SHA512 c013dbe0ddea948c8c6cf17916b499d171e83a204c5e5da3d6c5ff41ee13689cc7cfe8c9871b2e70d67b8655eb4a565afdb32f3295337b69ea117bb086cd8706
SSDEEP 12288:aO4rfItL8HRXDtJDZ7E9Euchj3TWIu5nN/Uy6kk6eh7K9wlsDpVFd:aO4rQtGRn9QqyN6kk6eh+9wlsDpVFd
TLSH
T16EA4E12A7681C233D2D201751BD6CBEAA63E79B10726A4C337D4067D2F616E1D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5624	791E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5624	791E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_e30ce06f038e5d1cd4cceebbbdcfef6c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	791E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4556 wrote to memory of 5624	4556	2026-07-23_e30ce06f038e5d1cd4cceebbbdcfef6c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_e30ce06f038e5d1cd4cceebbbdcfef6c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_e30ce06f038e5d1cd4cceebbbdcfef6c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4556
- C:\Users\Admin\AppData\Local\Temp\791E.tmp
  "C:\Users\Admin\AppData\Local\Temp\791E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-23_e30ce06f038e5d1cd4cceebbbdcfef6c_elex_mafia_stealc_tofsee.exe 19FA17E7E22D08627F3F86831035507E069FB3F40CAE4400867ADD94F737ACFE6F97F823877E233B7608C77026C0FFD558C3D61C6C11889E4CC4AC1DFF7526C8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

791E.tmp

Path C:\Users\Admin\AppData\Local\Temp\791E.tmp
Size 476KB
SHA256 7dea92a8ce46ad7314e740910b35d0cfd35a9b6d0b93627f71de8f4cc5b85a89
MD5 76986abe781f482e74a9a4a41725f0b5
SHA1 8b0579143791ca0e21549febe44bb130ae1484ce
SHA512 057b6861a69b19c21f46f73097351fa0d5656b823d7d71e2de5db8e0c16dbceefcb1a6a149c285e3f1425ec6d18860e3d4b3f81a27eb7c43c7cbbd1ff39c9de5
SSDEEP 12288:aO4rfItL8HRyPadMBYVu5QE7K9wlsDpVFd:aO4rQtGRyPauBIjE+9wlsDpVFd
TLSH
T1C3A4F1257682C233D29302754BD6D7A6B63E75B5032AA4C33BD4027D2F65AE1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download