1eab47f55dc7fd86973bcc3c115ac4e248e748cc5cfaf0a3951832f65520366a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_d9721d701e748c11249a8f8d9a19bffa_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260730-dbccta1xay
SHA256 1eab47f55dc7fd86973bcc3c115ac4e248e748cc5cfaf0a3951832f65520366a
MD5 d9721d701e748c11249a8f8d9a19bffa
SHA1 bfff670e386c24f4f589c25f763d28bdc2817cc0
SHA512 2395815e39d35fdab36bac718ec7f995f13bdfe3dd232b44a703a1f9e1d7c42619808facb30d0f6c523c66196a88535eb4ce2c94fa7f7025b713d4664293d644
SSDEEP 12288:Nb4bZudi79Ln9LIWte6A1X5GQtS3Z8xJpybVA0a:Nb4bcdkL9cr6A8CwA
TLSH
T1CCA4E0243182C037E19612350BE6D7B5653E3DA10F32A8D73B947B6E6EB02E1DA39357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3336	7A66.tmp

Executes dropped EXE 1 IoCs

pid	Process
3336	7A66.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A66.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_d9721d701e748c11249a8f8d9a19bffa_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3348 wrote to memory of 3336	3348	2026-07-30_d9721d701e748c11249a8f8d9a19bffa_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_d9721d701e748c11249a8f8d9a19bffa_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_d9721d701e748c11249a8f8d9a19bffa_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3348
- C:\Users\Admin\AppData\Local\Temp\7A66.tmp
  "C:\Users\Admin\AppData\Local\Temp\7A66.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_d9721d701e748c11249a8f8d9a19bffa_elex_mafia_stealc_tofsee.exe 3290D231061C52E00005DF772F8198D01101C5AC76912658B02CCE61BAADFF2DFDF620C362DEA5FE921B1990EBD0E9B9DBC027605AF941734990FC785F9BD1C4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3336

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7A66.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A66.tmp
Size 473KB
SHA256 9a2c00fba8e4ac56c7c594837500479bc591a67f3d52085d44d980abad0621c1
MD5 b73fd6d953af3e057b37e70bb864b81f
SHA1 9e7891fa7462463102ddcb32401be71830302973
SHA512 5e6b7ff96a0493cdec28bd0f22a66f3b9cdc80eb7bb52a8b688952ece126f274caa3cdc2501aeff9279fd761981915711d183ff6d1b9e7bc1a5a08473e21dcaf
SSDEEP 12288:Nb4bZudi79LlmDNDaxJjY1KtTw/uezaQpCA0a:Nb4bcdkLeda7jYI2u4
TLSH
T1C0A4F1243581C037E19702354AE6C7B6663A7DA15F3164CB3B947BAE6EB02E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download