87f802a95c55710bd559cd1ee7690a7c25fc7b6ff59aa4e94188f84bb3f3c708

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 12:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260728-p8a2sshd39
SHA256 87f802a95c55710bd559cd1ee7690a7c25fc7b6ff59aa4e94188f84bb3f3c708
MD5 5225f0492e9fbadbc389ee7e0b79a687
SHA1 1c3b061086bcea70391574d0d4ba873da7d918a4
SHA512 f521f3419fc4389919942a933c92585c9ca323da637417579d4f141662caa9a0e516033e51a711cea6b8516edbe318506a036cdd11dad1a8d60b962034053f06
SSDEEP 12288:Nb4bZudi79LUFAgpYBZ9oqzxyC0Ij4h9x1JLBnlzP6aA:Nb4bcdkLUFAGqkR93Rh9
TLSH
T1D3A4F0243181C037E25306354FF6C772697A38A14B2668C73BD46BBE6EB02E1EA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4088	3147.tmp

Executes dropped EXE 1 IoCs

pid	Process
4088	3147.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3147.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 4088	5900	2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Local\Temp\3147.tmp
  "C:\Users\Admin\AppData\Local\Temp\3147.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-28_5225f0492e9fbadbc389ee7e0b79a687_elex_mafia_stealc_tofsee.exe 140AE3FDF78C4F18F04193F792193BC10C1E146C96F34C55F503F68664DDAD8112E7A048A1A7AC2E5D5F203392C3894475D863A0D30F2D243BA9D5A7ECB1FFFA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3147.tmp

Path C:\Users\Admin\AppData\Local\Temp\3147.tmp
Size 444KB
SHA256 da9724c1e566cd1bbd6e547af85646dfeecf0fc089ccfb52840b9f1bfe130a15
MD5 77652bfb043a5b86ad33a8200b0ac51b
SHA1 ada8605a467472baa8ce11a2f6d6412b8469d165
SHA512 7cb8408205789f82621980fec9615cc6cc266123c42b4d23eea1fda09f7bc390657916effebdf53a3559da5ea11ed9a1f1b00a70459f61e639ae347a580ae82a
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStnQ+IJ8Ag7X2sx2swfbFQ+YlAbsb2mZBnvj5:Nb4bZudi79LcQ+3DXjDwDy+YXt5db8A
TLSH
T188A4F1243581C037D29715394BFAD726567A7DB14B2268CB3BD42BBE1EB02E1E630397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download