497133ae706fe88dde9319783b45061a5f2a600b28d1c6496a20c19f0af2a750

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 11:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_0f7b30f8ef1f89c84428c1fcd4f1e23a_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260730-nvjlcahn4w
SHA256 497133ae706fe88dde9319783b45061a5f2a600b28d1c6496a20c19f0af2a750
MD5 0f7b30f8ef1f89c84428c1fcd4f1e23a
SHA1 5fac1dcf4e3e04d8d29505bea90c7835f094b1e0
SHA512 c281933066e734574e95ed51a27b9fa2ab03f524dfef700b11ce91aeb1c1c606c0dcd5390f0776a4f10ce488922002974860af8c3dfab69af0f907ae72622000
SSDEEP 12288:Nb4bZudi79LTbRUswjIhBW5LTcSBT8R3A:Nb4bcdkLTbRUtyWVZBT
TLSH
T1B0A4F1253192C033D1A712398BE5DB76663E79A14B2168D737D42B6E2EB03E2E730357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5832	F6CF.tmp

Executes dropped EXE 1 IoCs

pid	Process
5832	F6CF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_0f7b30f8ef1f89c84428c1fcd4f1e23a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F6CF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5888 wrote to memory of 5832	5888	2026-07-30_0f7b30f8ef1f89c84428c1fcd4f1e23a_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-30_0f7b30f8ef1f89c84428c1fcd4f1e23a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_0f7b30f8ef1f89c84428c1fcd4f1e23a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5888
- C:\Users\Admin\AppData\Local\Temp\F6CF.tmp
  "C:\Users\Admin\AppData\Local\Temp\F6CF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_0f7b30f8ef1f89c84428c1fcd4f1e23a_elex_mafia_stealc_tofsee.exe 5FAA8161B3FBB3EEC8E3A323E8F4F040400BE4422D3CD1CAA9A244C07F4DB22020BED2283074C9696E03E17955727E2A9C516B5B736A077582B582A536236AA5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5832

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F6CF.tmp

Path C:\Users\Admin\AppData\Local\Temp\F6CF.tmp
Size 444KB
SHA256 12661b83b377360ce907445b2f6a3b5f1fc829cc2f9bc6c60f0b45dee7cdc6a6
MD5 1778ab4ee625139d7f0f2d95c3344b86
SHA1 4217d83538f14ef5abc063b95aa81bd6501c9005
SHA512 7f789591e153429cc5d9dc66492cae5f448b1bd29d656d5b5ba5041c6f821e44b300abdfb34930a2012a4eb257baaf52901ddb3175a8415f04f3fa1266ac5406
SSDEEP 12288:Nb4bZudi79L4zU+ldTsv5KwImseYwY3MA:Nb4bcdkLodTsv5KwImseY7
TLSH
T146A4E0243692C037D29711354BE9C7A5A97E3DA14B2268C73BD46BBD2EB03D2E635343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download