c76478766ba4d6f09695d89c7f15d7c84d620509b12fcd9413a80c4ada7b609d

Analysis

max time kernel
150s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 22:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_7f3547ec378a7824b8a5dc743d7bf8f6_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260724-2vs2nsvele
SHA256 c76478766ba4d6f09695d89c7f15d7c84d620509b12fcd9413a80c4ada7b609d
MD5 7f3547ec378a7824b8a5dc743d7bf8f6
SHA1 c9957486596bbc47eaac1af6d16423d626721e76
SHA512 a580869898c83424cce5529a949c330868fcc73f95a57b6dd3b257566d3fe48f52d7373b824f04dee62ad6fb90314150f8935da71176b9ccfca9a3be19fe4f83
SSDEEP 12288:Nb4bZudi79LhDpFf0A+PRxT9JDpCbcK3MF6eWbMKS78e6dgYA0a:Nb4bcdkLhDIPRx5mYnF6hMKS7N6dgL
TLSH
T1EFA4EF243282C033E29702354AEAC7B5697A7D615F3564DB3BD03BAD6EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4440	2F44.tmp

Executes dropped EXE 1 IoCs

pid	Process
4440	2F44.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_7f3547ec378a7824b8a5dc743d7bf8f6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2F44.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4468 wrote to memory of 4440	4468	2026-07-24_7f3547ec378a7824b8a5dc743d7bf8f6_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-24_7f3547ec378a7824b8a5dc743d7bf8f6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_7f3547ec378a7824b8a5dc743d7bf8f6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4468
- C:\Users\Admin\AppData\Local\Temp\2F44.tmp
  "C:\Users\Admin\AppData\Local\Temp\2F44.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-24_7f3547ec378a7824b8a5dc743d7bf8f6_elex_mafia_stealc_tofsee.exe F13C766F989370740DC8E8D2379AD716BFA1D35AFCC297174574B40CE4F7A863DAEFA39C75BB85AD1B2260FFB73E3C714878942181CDAC0D691A5DF714E92647
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2F44.tmp

Path C:\Users\Admin\AppData\Local\Temp\2F44.tmp
Size 473KB
SHA256 2c74866ebda2a2fe521098295cd55fef454160aa7fc728d81975663db13a3c7a
MD5 69a8f36723bd88b0c1c791d23dfc0c9e
SHA1 90fe60cd045b36d271ec020ef16e9a714ea704ed
SHA512 c57f5f6b3e8db5d5fbcd0d62ccff852005c9670e803e356aeaee7cd847df5afc95dabb721432fd7791415bb297be3c5430f1d14cb18d0130a93d0f41d3731aa6
SSDEEP 12288:Nb4bZudi79Lpip3pyoIh8OAXOFYIJFA0a:Nb4bcdkLpygte+XJ0
TLSH
T108A4E02035D1C037E1A716384AE5CBB6663A7CA15F2168CB3BD0376E6EB02E1DA35317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download