9600fb7432d483a0493ad36645c49400ab593383cefb2da07ff975a34778354e

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 01:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_2c3728b639e74bafc413ca1b06d11b85_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260730-by33yaab35
SHA256 9600fb7432d483a0493ad36645c49400ab593383cefb2da07ff975a34778354e
MD5 2c3728b639e74bafc413ca1b06d11b85
SHA1 b20a9118b826e5a59b47fb8079b39980ce43c3e8
SHA512 3a909988a90909e8249b5b328c14eed1aac08c81681a3404f1badcc78fa9ee11332c844882a8125b6d1c6e56848158a7aab80a8920060b12acba993219602114
SSDEEP 12288:Ci4g+yU+0pAiv+0ScHsnaxrVRva6RQq0JnTgZGJfvxEp9Bjn:Ci4gXn0pD+0tdVJQq0JnUZGFxk
TLSH
T18B94F1353582C033E69605714BF5DB6A667D79A2472668CB3BC40BBE2F603E2D235347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2308	455C.tmp

Executes dropped EXE 1 IoCs

pid	Process
2308	455C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_2c3728b639e74bafc413ca1b06d11b85_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	455C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4116 wrote to memory of 2308	4116	2026-07-30_2c3728b639e74bafc413ca1b06d11b85_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c3728b639e74bafc413ca1b06d11b85_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_2c3728b639e74bafc413ca1b06d11b85_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4116
- C:\Users\Admin\AppData\Local\Temp\455C.tmp
  "C:\Users\Admin\AppData\Local\Temp\455C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_2c3728b639e74bafc413ca1b06d11b85_elex_mafia_stealc_tofsee.exe 1A4901E39DF06674215EC095911D69779C4A9BED56B779BD482E6FA88500B792B144EB62E97AAC23EFD2FDEEBF7DB164DA36AA8A80FB086D524D65011177990A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2308

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

455C.tmp

Path C:\Users\Admin\AppData\Local\Temp\455C.tmp
Size 433KB
SHA256 0f86d8356ced082689fd7411dcf176be2e3d33202fecf8e6912ec1be71e87b42
MD5 b4fe96e48c1917b430a186d1260131e3
SHA1 0ab595b999d4359b466abfed095cda3bf6dfbaf6
SHA512 54accded415d2ee5283ca76e4e4a8bebb4f800c529117e395a8fb5a4a788014988df378bea6053d8c5a2d5d6c49c5135b475cffe97787c020fda03ba9a298123
SSDEEP 12288:Ci4g+yU+0pAiv+acRUodAgtrPVtnO30kutfyn:Ci4gXn0pD+/RXtrXcfe6
TLSH
T13994F1217482C033E2A715354BE5CB662A7E7871472368CB7BD41B6E6FA02D2D77438B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download