4f668bc42ee8760b3a571b8a099e6cab042366a14e243de62f9144a11eb2d010

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260723-pygrlaygra
SHA256 4f668bc42ee8760b3a571b8a099e6cab042366a14e243de62f9144a11eb2d010
MD5 d863202124bac66c551d1342b932c184
SHA1 2465fd9881b9a1f1955bf7cb6cbd86d802ac59a8
SHA512 42bee53f9c1cacb50e65c100abfb3f7735a57e3fff3a09b379bca8b0fbd53edbabf81f21b78931cb3c02b27a7fdb61209f195dca5506fb906c8ace842bcbfb95
SSDEEP 12288:Z594+AcL4tBekiuKzErNrR59SJpQaFIenWD7zIxtl:BL4tBekiuVrlRRaKvPzIxt
TLSH
T17794F1353186C037D6A712394BE1C76A197E79B60B26A8C73BC42B7D5EA02D1D73438B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2420	2EE6.tmp

Executes dropped EXE 1 IoCs

pid	Process
2420	2EE6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2EE6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 2420	4592	2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\2EE6.tmp
  "C:\Users\Admin\AppData\Local\Temp\2EE6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-23_d863202124bac66c551d1342b932c184_elex_mafia_stealc_tofsee.exe 5C9C8C14CEDA36EE1AB0C7E868F69E10ADEE48AA42DBDF07D1F726762E911D409CF2CA141F7E8AA9E86CE51B80AC0BA9D29C11C8DCD44074C6D546B41B3F43EE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2EE6.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EE6.tmp
Size 428KB
SHA256 5889f7d9cc0dbc8a5cf9850cbb1dd238d116a8a787a8ad863c81a3c6f3fdd27a
MD5 26faeb4d0892d2a2ec13d1461db26637
SHA1 38a4525327e9023b6b8a6d5a338e1fce45b27293
SHA512 7385e6d31e5b1aefed7ceef6fbf46f6caabcdc2bc62b50f394d82e6392ebdfe422d52733cc323617401c840a632968cb3122b293efd72a0954815bb2328cf375
SSDEEP 12288:Z594+AcL4tBekiuKzErwHrw1QdW2CiPJbYP9ul:BL4tBekiuVrw93CiPOu
TLSH
T1AE94E0353586C033D29716384FE9CBAA557A7AB60B26A8C73BC0177A1E643D1E73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download