e4acf3d675526a83a1bef937adce7d43b9180ba2617efc8709062032ade3ca17

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_c7808a066a2e619f5e464636d5f6a90c_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260728-cs4yqawdnd
SHA256 e4acf3d675526a83a1bef937adce7d43b9180ba2617efc8709062032ade3ca17
MD5 c7808a066a2e619f5e464636d5f6a90c
SHA1 c9f7b944bba6e8af163041b65f0bd09cfddfd00f
SHA512 f870893106b2da8fe516ccc40e6cb0873253b9c59a8e80f13ca4cca4d080436c15c782824e7d5cc5f6d5f09d487bc6386d759f126c6a6ba4677a094f92b18be0
SSDEEP 12288:fd4x+ePixnXQjF4cs5X8eyHFBjgMxlD2TDZJwP:fd4x+ePixAj4gHFBvWTT
TLSH
T13394E0213682C036E1A719344BE5DB695939BDB01B72A4C73BD42BAE6F742D1CB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5112	F19E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5112	F19E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_c7808a066a2e619f5e464636d5f6a90c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F19E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4132 wrote to memory of 5112	4132	2026-07-28_c7808a066a2e619f5e464636d5f6a90c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_c7808a066a2e619f5e464636d5f6a90c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_c7808a066a2e619f5e464636d5f6a90c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4132
- C:\Users\Admin\AppData\Local\Temp\F19E.tmp
  "C:\Users\Admin\AppData\Local\Temp\F19E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-28_c7808a066a2e619f5e464636d5f6a90c_elex_mafia_stealc_tofsee.exe CFA11FFA2B6B37414A95571C16355680DE007992B3DBA268250E4CB640F7AE56A72A79A32978ACEC72C356A4E5DD57888675BBA4EFF5A00C29EF220ABD5EE00F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5112

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F19E.tmp

Path C:\Users\Admin\AppData\Local\Temp\F19E.tmp
Size 435KB
SHA256 eef702217758d88db7538eaa6649ee8e0d92d3aff81aaedbaebc146f48724603
MD5 d9e9322972ed59830fde9c0b5de503cf
SHA1 1ba34b230f15f81f7a8a2ac0cbf4cf7483d4647a
SHA512 525fb84cfce3a2909f37c3f4c1679a7ac9804c2d8e8a7ea88ec449984631d4c247d803149766cf310360f95cfeccfdc22d7675f90779b022976c485d9c6ee764
SSDEEP 12288:fd4x+ePixnXQjqYYyEtUYNhwbB3LVPwP:fd4x+ePixAjMTqBbV
TLSH
T19294E0213686C03BE1A315388BF4CAA959797DB14B35A8C73BD42BAE5E742C1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download