823600f5ba4e6a1b386222595bb77fd7ef42d3e7f5a4e62bb87b562d4effcdbe

Analysis

max time kernel
150s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 02:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260727-cfh6gsfr21
SHA256 823600f5ba4e6a1b386222595bb77fd7ef42d3e7f5a4e62bb87b562d4effcdbe
MD5 8e2a861caf863804b460e9de9f487006
SHA1 fa191eafb76d7fd7bc9d64aa5e5811776b04c37d
SHA512 002f44ef9401550cad35e6a011a0c4f816c59eaddd6e68cf2c90665a46d9a1452265ed48dd43f0b549dab8ff380dcfc31f650567161c28fa330c78710aa77542
SSDEEP 12288:fd4x+ePixnXQjonQjtnsLQZMNHrIW+pUnwP:fd4x+ePixAjNsLQZMGWEO
TLSH
T12794E1213686C036E1A706384BE5DBA9597E7D704B32A4C73BC42BAA6F751C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6316	7064.tmp

Executes dropped EXE 1 IoCs

pid	Process
6316	7064.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7064.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5136 wrote to memory of 6316	5136	2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe	91

C:\Users\Admin\AppData\Local\Temp\2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5136
- C:\Users\Admin\AppData\Local\Temp\7064.tmp
  "C:\Users\Admin\AppData\Local\Temp\7064.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_8e2a861caf863804b460e9de9f487006_elex_mafia_stealc_tofsee.exe A7FDE86FF1C637D98E7875BA1D1EB4BBB93FCB8CEBE574638DB645B1171A49314000E5F58B04C7C08C611E443055E317020C1F3FB74415A6440B8A83D587A8B0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6316

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7064.tmp

Path C:\Users\Admin\AppData\Local\Temp\7064.tmp
Size 435KB
SHA256 aca737b3ef7d3084ccfb75a58c76cd714ad15a0f1f253f991a9aba3b44dbd83e
MD5 5bf4e809db2b28fb4f97360a1df1b13a
SHA1 1af1363ae1b18d692cdbc3535416fa6c110298ff
SHA512 a31f5cd2868f982272db63c239d7d24b8e8680fd1edb95f20f6706fe1660cbe801e7a53fa777fe7b52d2fbe64fbe911972a97359624304fe9136081b7092c75f
SSDEEP 12288:fd4x+ePixnXQjRQ0lLN0f70o9HH82pcwP:fd4x+ePixAjzW0wcb
TLSH
T1F394E0253682C036E2A715394BE5CBA9597D7DB00B32B4C73B942BAA5F702D1DA3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download