4f65b9ac1e1d6321ad49557b362554051cdb2ac2d1cfcc8c2941adf9642a3fee

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 13:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_4ef2d589198e7e1f470410e29fbe374d_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260727-qh36bsbb52
SHA256 4f65b9ac1e1d6321ad49557b362554051cdb2ac2d1cfcc8c2941adf9642a3fee
MD5 4ef2d589198e7e1f470410e29fbe374d
SHA1 60c52f9e9a0624ded461e6182b6a6af7896e30ef
SHA512 50cffe152ebb3299b3890a0c155d5bb07cb4a61ff408f679f0251720feb8275bda68eda4fbd1f9cc16459276e1d0ee3de6abeaf4ea3335e12e8ae865056011e0
SSDEEP 12288:Nb4bZudi79L0rXdiVnBLNkkUIW5gE4FjfA0a:Nb4bcdkL0RiXLO/5b
TLSH
T134A4E0243192C037E2A711350AE6C7B5667A3D618F7268C73B907BBD6EB02E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2612	B404.tmp

Executes dropped EXE 1 IoCs

pid	Process
2612	B404.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_4ef2d589198e7e1f470410e29fbe374d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B404.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5876 wrote to memory of 2612	5876	2026-07-27_4ef2d589198e7e1f470410e29fbe374d_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-27_4ef2d589198e7e1f470410e29fbe374d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_4ef2d589198e7e1f470410e29fbe374d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5876
- C:\Users\Admin\AppData\Local\Temp\B404.tmp
  "C:\Users\Admin\AppData\Local\Temp\B404.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_4ef2d589198e7e1f470410e29fbe374d_elex_mafia_stealc_tofsee.exe D521A3CDDA4268B3DCC08FA1572E1A28E1E98CC4F305BC2DD577A5046962CD5A5F0D453D82DB0504A4F1F43396262343D4DFEFBF66A5A3F4484539EBF190258F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2612

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B404.tmp

Path C:\Users\Admin\AppData\Local\Temp\B404.tmp
Size 473KB
SHA256 33c7384e8fe2cbfb406e4853d8c6e0351b8e715144141f5470a243e674d55e98
MD5 9141192ad0375b786a46406aeb2e667a
SHA1 2e2c9d9b66ba73a77f835ee66641fa6ead9506fe
SHA512 abd63c4a3a9257d3e1a7105a1d0cf531b1567425b8ef3639ff5f398a77a3c201671c2a6b535fa64deb11223d6d03a717faef9129ebc2e2c7aa9481bfcda6bd30
SSDEEP 12288:Nb4bZudi79L41xgsRy1PZ1wlLtZPBcP4QTSJA0a:Nb4bcdkLWgpPElRZZcQQTF
TLSH
T11AA4D0143182C033D1A701354AE6CBB5653A7DA19F2664CB3FD43BAE2EB06E1EA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download