586ce43d5ab1e01bd457d077a6926b03c910fe17b4ae2d9f8dafc6bf4b311379

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
24/07/2026, 19:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-24_853cb1b2c633c28ea9fb4079be6e2618_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260724-xt2vzabl51
SHA256 586ce43d5ab1e01bd457d077a6926b03c910fe17b4ae2d9f8dafc6bf4b311379
MD5 853cb1b2c633c28ea9fb4079be6e2618
SHA1 d11d3cb66e75fde078235e11da5b68fdc71f440f
SHA512 86cd01fdf1e3cfddc1509b66bdf42e8ef1d944c3e50c5b6cc137c308cd2eae719c69a3c6f115626f7accbaf931a73bacade1a75f86013857ce1800b316efc297
SSDEEP 12288:Nb4bZudi79LSEh2Ne3YFn8svDZZxUkiaA0a:Nb4bcdkLPV3YFth9ix
TLSH
T1ACA4E0203291C037E29702394AE5CBB6563E7DA15F22A4DB3BD43B6D5EB02E1DA34717
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5048	546.tmp

Executes dropped EXE 1 IoCs

pid	Process
5048	546.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-24_853cb1b2c633c28ea9fb4079be6e2618_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	546.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2420 wrote to memory of 5048	2420	2026-07-24_853cb1b2c633c28ea9fb4079be6e2618_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-24_853cb1b2c633c28ea9fb4079be6e2618_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-24_853cb1b2c633c28ea9fb4079be6e2618_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2420
- C:\Users\Admin\AppData\Local\Temp\546.tmp
  "C:\Users\Admin\AppData\Local\Temp\546.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-24_853cb1b2c633c28ea9fb4079be6e2618_elex_mafia_stealc_tofsee.exe 20E22B67723D1469867D3BDA19E214744B721D25A6466582F3F43B2BCC40E056010B033A46F1FB06467BC6696791B7BBDB7851F8715651AEB669F61123FFD20E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5048

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

546.tmp

Path C:\Users\Admin\AppData\Local\Temp\546.tmp
Size 473KB
SHA256 8000bd9ea5ae47ea12cccf9c3948d22d094b542a5b1a6cc2d7d6d31ade9a94aa
MD5 aafcfe427a0b0425623102fd3f977d09
SHA1 2418c9f3ad7fb5b9e47169df08d7c5f45ddd708b
SHA512 1ac47889947a742b11d55829ca0c6957fcf9771f9ffcba1cae1e15d82620e2b642c21254575d88b558b975e4ff33bc91f7c2c3ac66c08dd405e44825e4e54870
SSDEEP 12288:Nb4bZudi79LiVJxkkNj3CDRE/PsoCmUavZ/A0a:Nb4bcdkL+Xkk9+m/PsXus
TLSH
T1BDA4F1253181C033E2AB01354AE5CBFA567A3DA14F21A8D73BD4776E6EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download