45c40ced8bf8f7606484c5ffd816aaa1f7bcd254cc99bb28ccc975a13003c325

Analysis

max time kernel
150s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_0fd599ffe742e1952f0b400d52668094_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260730-gpmmgsdn8w
SHA256 45c40ced8bf8f7606484c5ffd816aaa1f7bcd254cc99bb28ccc975a13003c325
MD5 0fd599ffe742e1952f0b400d52668094
SHA1 e556780b51155c1ebc4f8da79485c592b56d1f4d
SHA512 583aad7214a656b14d4f6ecf495cec7fdef567d17f124c5003f6557b43efc3bac4674b0dc7ebff09c31bbfbad9651b7d1adbb7347fb45db37307be348946ee32
SSDEEP 12288:Nb4bZudi79Lbwm0xzOi+0TM/Nh71Bozb9MNTlBt2nZA0a:Nb4bcdkLbw1xzl+0TyCzb9MNB6g
TLSH
T111A4E0207681C037E2A706350AE2C7B1667A7DB19F6568C73BD43BAD6EB02E1D634317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4120	F75B.tmp

Executes dropped EXE 1 IoCs

pid	Process
4120	F75B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_0fd599ffe742e1952f0b400d52668094_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F75B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1916 wrote to memory of 4120	1916	2026-07-30_0fd599ffe742e1952f0b400d52668094_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_0fd599ffe742e1952f0b400d52668094_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0fd599ffe742e1952f0b400d52668094_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1916
- C:\Users\Admin\AppData\Local\Temp\F75B.tmp
  "C:\Users\Admin\AppData\Local\Temp\F75B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_0fd599ffe742e1952f0b400d52668094_elex_mafia_stealc_tofsee.exe CA70625F5A7F061EB1AA9963BC526AF2BD2AFCDBFB2A1DFA3CFC2508701496118E56C202600AA34910D761A5B1B4E1DA168F41E9B0B50C5D6E6C6B20A53E56B1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4120

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F75B.tmp

Path C:\Users\Admin\AppData\Local\Temp\F75B.tmp
Size 473KB
SHA256 3e23e0bfaeb6f6025aada204eff7192fdce60ad32786ac0b4408094648aee3c0
MD5 cedf3350327088990b19e074a9e2ce3f
SHA1 85916a067c1ced4e7d7125eeeede37820a9139ce
SHA512 11bcf5fe65cb6f75005b3b8da796f17ac19c6711b0c288a9708eb98d760af9a4aca9995bb5e82995341dddf6326a5a9251aab23922af8f2efc6b78779f68ff4c
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStlme/h+9VfD1stkH3v15rbU27cJ+8793rgrv:Nb4bZudi79Lk+XfD7H3t5kb+cRMjIA0a
TLSH
T1E9A4E0243581C037E2A706344AE6CBB5553A7DB15F22A4CB3BD47BAD2EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download