3677a91d8ba5702d89fb44b228ffc44b6f232987ab74344ae798d155f8ae1477

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 06:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_a3d32b933d9fcd6e0350a2bf217d0bb1_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260727-g6ctlsw1b1
SHA256 3677a91d8ba5702d89fb44b228ffc44b6f232987ab74344ae798d155f8ae1477
MD5 a3d32b933d9fcd6e0350a2bf217d0bb1
SHA1 4ceb22a490e1fd5c02530cd52e78897815549064
SHA512 7e40d22ff42595479b6113dfa86c5c11853f40fd188f43fd6d999206d9c3da8e8ed06abb83c00d1758699b3db9f25727b23fdafbefaa510ce85d391fae8c1d21
SSDEEP 12288:Nb4bZudi79LJCreKzmO82PBJr83LlGjGVNMA0a:Nb4bcdkLOC3ca0jK
TLSH
T1CAA4E0243682C037E19716344BE5C7B6653A7DA05F21A8CB3BD43BAD6EB02E1DA35317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4212	4646.tmp

Executes dropped EXE 1 IoCs

pid	Process
4212	4646.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_a3d32b933d9fcd6e0350a2bf217d0bb1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4646.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4636 wrote to memory of 4212	4636	2026-07-27_a3d32b933d9fcd6e0350a2bf217d0bb1_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_a3d32b933d9fcd6e0350a2bf217d0bb1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_a3d32b933d9fcd6e0350a2bf217d0bb1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4636
- C:\Users\Admin\AppData\Local\Temp\4646.tmp
  "C:\Users\Admin\AppData\Local\Temp\4646.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_a3d32b933d9fcd6e0350a2bf217d0bb1_elex_mafia_stealc_tofsee.exe DAA22DD0D1E648A6D30C7F84012736337BF190717C01116C840465A037F770089FA06C74056B71CAEE964DA6FC06EF18737045503FD08597BB7489F51311BDB7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4646.tmp

Path C:\Users\Admin\AppData\Local\Temp\4646.tmp
Size 473KB
SHA256 5776c9c5dcf75955fab5f878e6343a9d6aa04d088663004acd749ffaa8bd9425
MD5 0abcf25e566c3dc75b03fee37d6ed352
SHA1 2180d786613139dd91549cd09e110b5620e3c523
SHA512 b3ba6756ad3ed9d5d8826dc3af1626a91be403681cdd488b0d7b025f69ac442c2a12812af1258b54a8353901c4f312850bc8a1cdfd7cf3b98878ac56f53c3c80
SSDEEP 12288:Nb4bZudi79LxidBVdkSx1vahGM2nIBg1PgOgliDb3xc7/A0a:Nb4bcdkLQkKvUmnIBgp60b3d
TLSH
T13AA4DF243682C033E29706340AF6DBB565BE7DA15F2164CB3B90776D6EB12E0EA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download