2546375ae8b5139d48b6015d23e14a1b049a98e6b46b7a1b0e74dadeec40bcdb

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 10:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260724-mdds4acl2t
SHA256 2546375ae8b5139d48b6015d23e14a1b049a98e6b46b7a1b0e74dadeec40bcdb
MD5 4a2b2342419628458bb038050f16e434
SHA1 2bdbe401d1104d044a28387bf634f5a5a6acec32
SHA512 5fc568a4dea569b53b9c8824fcd5bd004f837d52e52c499e81a30fef8f4768aa7d1053e79e0aa0e0ce8d23c089d0e2a6fdf4af2b233382c50d96b9d549e6ed12
SSDEEP 12288:Z594+AcL4tBekiuKzErZNajzQjTzz6dCVGS6IN9hQJl:BL4tBekiuVrLZjvCm0S9Q
TLSH
T10694F0203482C037D29B12384BF5CB7A627F79B64B6668CB7BD417AD5EA42D1E630347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6092	91E6.tmp

Executes dropped EXE 1 IoCs

pid	Process
6092	91E6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	91E6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1908 wrote to memory of 6092	1908	2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1908
- C:\Users\Admin\AppData\Local\Temp\91E6.tmp
  "C:\Users\Admin\AppData\Local\Temp\91E6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-24_4a2b2342419628458bb038050f16e434_elex_mafia_stealc_tofsee.exe BA8F9E268CCEB0228EE94EDD40E2D6E95405C4D186C1A80E1A71A286E3CDB037C606EE03BB89CB0C579DDE773A9173BB264294838D3B5A3D91CE28C999B23F29
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

91E6.tmp

Path C:\Users\Admin\AppData\Local\Temp\91E6.tmp
Size 428KB
SHA256 d6d08edc491e6924c9d47fb9af9d645459a472b79af67695b499659efb63866f
MD5 7abfccac3c3076fd937c5df42cc6b60e
SHA1 a22f2fdee36388978f87b86f6243bedf44b1ad72
SHA512 190a75b57983fd21c4272ad92c45601823fb925680b0c3e8e18bd8860f21c9e3fe9975134fd9ea4cd328cc500e692a2815338ec4e1290662f31ef8c77296b28e
SSDEEP 12288:Z594+AcL4tBekiuKzErOA8FG0o/8VXcPRZUltVE6wCwn/l:BL4tBekiuVr/R8EROKsw/
TLSH
T1C794F1253491C037E6AB26344FE5C76A1A7E39B50F2AA4C73BD01B7D6E642D2D63034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download