53a69b0c4c304053278e25f5093bbc98555d0c0bf116a811e3941437a2ebe70b

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 13:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_00697b7825ddcd481fcf8e42079031ed_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260723-qb52cadj9v
SHA256 53a69b0c4c304053278e25f5093bbc98555d0c0bf116a811e3941437a2ebe70b
MD5 00697b7825ddcd481fcf8e42079031ed
SHA1 b020c5aa9507f4b3cd62f45a9fc74babe2d7c691
SHA512 91eff95029094c814e947e50c8653648d27cba0d00721d92129befe44b24ce5f808f7b0259f13eacfa89a1b956a2b660dc6ac4175d8770ab39a2ef84e132114d
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStQXRyuwVpVMrHDJF1hV/7uIW6x+v8vxRHxkF:Nb4bZudi79LByPgDB/ywwv8vTRkODA0a
TLSH
T1EBA4D0147581C037E2A702344BE6C7B6A63A7CA14F2165C73BD47BAE6EB02E1DA35317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4864	812C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4864	812C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_00697b7825ddcd481fcf8e42079031ed_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	812C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1188 wrote to memory of 4864	1188	2026-07-23_00697b7825ddcd481fcf8e42079031ed_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_00697b7825ddcd481fcf8e42079031ed_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_00697b7825ddcd481fcf8e42079031ed_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1188
- C:\Users\Admin\AppData\Local\Temp\812C.tmp
  "C:\Users\Admin\AppData\Local\Temp\812C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-23_00697b7825ddcd481fcf8e42079031ed_elex_mafia_stealc_tofsee.exe 692A2215F1A0F5BF2B0832C2AA05E7B4E0A6170D9BCA3040C5BA8F3917DB3DDDD0F6768E65FAC510143EF1622592C240301791CACEC9CFF45FF735A5E7D2223A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4864

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

812C.tmp

Path C:\Users\Admin\AppData\Local\Temp\812C.tmp
Size 473KB
SHA256 affe6e5fe6f0c175cd0a28fd62fdf4ff64367d5667e6e7e809af6a1de763f4b5
MD5 f0b1df34227560975a5ddd0ab98685a5
SHA1 4b5a777833921042879b6b8e11958727673746cf
SHA512 a5256aabb0d2cc24fc555a861f9b67f4e04b93b402ab3c9c632d44ea5ca7177085cd03d69fb9df4ab3f545dbb8263d2f1c1baaa1c8b397a7d06359022f56eba9
SSDEEP 12288:Nb4bZudi79LPSAx2rR92h4ap30pNzMCugA0a:Nb4bcdkLq4Gz2V1OzY
TLSH
T1C1A4EF253191C037E1A706350AE5C7B6657E7DA29F6268C73BD037AE2EB02E1DA34353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download