5a7f5bf361edcfb3c0f8a4328d5561e45f1806b277f51d0ed3f0723f1bb8d712

Analysis

max time kernel
148s
max time network
153s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 12:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_b864f2eff47638be3ea84ef8e3d999ce_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260723-pz7peaxset
SHA256 5a7f5bf361edcfb3c0f8a4328d5561e45f1806b277f51d0ed3f0723f1bb8d712
MD5 b864f2eff47638be3ea84ef8e3d999ce
SHA1 dcb82b6c9d1bee028ff30ee386adf32f5c0324a7
SHA512 c89e6e7823710c1f38f13b7dc2fe7ea828a6bb91fc75f342df03c494ddc4e2103aa0fdeff0a50ee810015120dc190cf21689801ce0955f41cbd7634d14a74e4b
SSDEEP 12288:Nb4bZudi79L3mL47/JquB+njJXwE8c62XXzA0a:Nb4bcdkL3mLwUuB+njBz84XW
TLSH
T142A4E0153292C033E1A716354AEADBB5563E3DA15F2268CB3BD437AD5EB02E0DA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5416	986E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5416	986E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_b864f2eff47638be3ea84ef8e3d999ce_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	986E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3452 wrote to memory of 5416	3452	2026-07-23_b864f2eff47638be3ea84ef8e3d999ce_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-23_b864f2eff47638be3ea84ef8e3d999ce_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_b864f2eff47638be3ea84ef8e3d999ce_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3452
- C:\Users\Admin\AppData\Local\Temp\986E.tmp
  "C:\Users\Admin\AppData\Local\Temp\986E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-23_b864f2eff47638be3ea84ef8e3d999ce_elex_mafia_stealc_tofsee.exe 9816B9E394E8F116D0CDFF3BE263622BECB6AFA8A86AE9A4FC84C4BB92348CEB391E0616D069B31C35DFE4740D1086B1F9B24EA3A730857F513175D603653DAB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

986E.tmp

Path C:\Users\Admin\AppData\Local\Temp\986E.tmp
Size 473KB
SHA256 1f4ed9fe4fce5c3421c590141b1d3ae881d3bb0640a63e04906ebeddfb81964e
MD5 723447a10f69fd7ba5301b8f13d53a43
SHA1 a05d3677bcc95abf9c53dc09230926dd5533f0f2
SHA512 03eef52d402bc12f7ea01080f994589c4cc62e9d865a950620ca27d76bf6aa31d801d06f6ea4dd8e679a49cbc5d7b03887317344b8961763da5b6ebf34def460
SSDEEP 12288:Nb4bZudi79L+lhHee0rkV4d6q5d1azOUdA0a:Nb4bcdkLGMeWK2/gfs
TLSH
T115A4E0243681C037D2A702394AE5C7F66A3A7DA05F2164C73BD077AE6EB06E1DA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download