87c4cbc69f4744ca19bf6be0f79870169eae90cb7d37366ba68fc5c20d8132f4

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
23/07/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-23_31cbe3102b14213f623d16b3feb84fc4_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260723-v5pcxacb97
SHA256 87c4cbc69f4744ca19bf6be0f79870169eae90cb7d37366ba68fc5c20d8132f4
MD5 31cbe3102b14213f623d16b3feb84fc4
SHA1 9c4019528203ee9e047fefd00a50286be34f2200
SHA512 d0b0f3b89339d409763064e3167c76d0e2e3e1b4c6d321be7219d38fc6da312bcf2d9043e532ec241f245cdb79ddef40da2f36b73b9a8d90118d5ede99ca18d6
SSDEEP 12288:Nb4bZudi79LAEUkKJxNECRrSH5k8aAe1IXLvR/A0a:Nb4bcdkLAEUkc2CIH5kVirE
TLSH
T197A4D0243191C037E6A706354AF6C7B6963A7CA04F2164CB3BD07B6E6EB02E1DA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4104	BCF2.tmp

Executes dropped EXE 1 IoCs

pid	Process
4104	BCF2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-23_31cbe3102b14213f623d16b3feb84fc4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCF2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4648 wrote to memory of 4104	4648	2026-07-23_31cbe3102b14213f623d16b3feb84fc4_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-23_31cbe3102b14213f623d16b3feb84fc4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-23_31cbe3102b14213f623d16b3feb84fc4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4648
- C:\Users\Admin\AppData\Local\Temp\BCF2.tmp
  "C:\Users\Admin\AppData\Local\Temp\BCF2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-23_31cbe3102b14213f623d16b3feb84fc4_elex_mafia_stealc_tofsee.exe 8B1C0E4CF040D733D9EF8CDF5F0072975440AC20059D253013D9D81FA2D1A2C89AF83F92A7D508267C90893007257D0E2C35FA1A307F3CDCC2F63DE619D38203
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4104

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BCF2.tmp

Path C:\Users\Admin\AppData\Local\Temp\BCF2.tmp
Size 473KB
SHA256 de5ea1631d0a79f5b5f2b86500f9727b5484a6c0c7a8e45b4341145484dd1304
MD5 141738bdbfbd35b1d3df9aa73cb21548
SHA1 9360afd297098c9d39d353fc018ff080b4af7dad
SHA512 840ffd6ea2bbc8d63f87b02fb99bf104780e73b63fb8ce262053b5666d5b65aaab39fc32025755fd0e6f8c29ba8c56ef52fb6de93a78ff1b6849f1a876ba7dbe
SSDEEP 12288:Nb4bZudi79LqcS8QWuRHeu83p5OEHXybA0a:Nb4bcdkLtuR+Np5Ok
TLSH
T184A4E0243182C037D2A706354AE9C7B5663A7DA15F2168C73BD077BE6EB02E2DA35317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download