4ee81987f6fb87e3f27c0a2168e86e53211c8bc5ed01f43d81473bc4e611e812

Analysis

max time kernel
148s
max time network
154s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/07/2026, 18:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-30_2cc20007c1d9f429e3c51207fb7c4a7e_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260730-wldmqsxtfz
SHA256 4ee81987f6fb87e3f27c0a2168e86e53211c8bc5ed01f43d81473bc4e611e812
MD5 2cc20007c1d9f429e3c51207fb7c4a7e
SHA1 af168427f8889506fb1e1ec5b82734f36f010a84
SHA512 5a75d37f1f6954d433291821c89b2412d80d590192d20e2024ad87b84f57535ebdcb07b8bb99f5443b6f75fc6902d321b79e08097fb22c7f5fb03670289fc257
SSDEEP 12288:Nb4bZudi79LmsF5D04NKpidRv4NbSVeodubiyO+BA0a:Nb4bcdkL3F3NK0dl4NbqWWy5I
TLSH
T165A4F0253681C037E19715384BE6CBB6563A7CA05F6168C73BD43BAE6EB02E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5420	20BD.tmp

Executes dropped EXE 1 IoCs

pid	Process
5420	20BD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-30_2cc20007c1d9f429e3c51207fb7c4a7e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	20BD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 5420	2672	2026-07-30_2cc20007c1d9f429e3c51207fb7c4a7e_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-30_2cc20007c1d9f429e3c51207fb7c4a7e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-30_2cc20007c1d9f429e3c51207fb7c4a7e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\20BD.tmp
  "C:\Users\Admin\AppData\Local\Temp\20BD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-30_2cc20007c1d9f429e3c51207fb7c4a7e_elex_mafia_stealc_tofsee.exe D66BA36B214BA74F1BE326E1B135C9BD83360734983299905C1590BE99610AEA9722D609CE11B6A430EFE5AD999D16EA1E45FA47CCCF1469A87E4ADF047958CC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

20BD.tmp

Path C:\Users\Admin\AppData\Local\Temp\20BD.tmp
Size 473KB
SHA256 eb74abdaf4868e43253ad6f899ed8d081990b16d9b0f49831615e9aba3cc0f4c
MD5 68f8d9e7b0be3b851c8b157fee986433
SHA1 8a980e6cb5f084f7e46318bd83331afbe452e7ea
SHA512 a1a50859ea4089701bf76d2e148cb40cee874cbf76439703d0c35ed80a563637530d99dea2636a5a20178ae29260e1c5b804a4f05488d408b58c961c09e015f4
SSDEEP 12288:Nb4bZudi79L2up36Tcj05AoxasA5MbQQcbiXQbA0a:Nb4bcdkL3p34GsWWcboj
TLSH
T16AA4E0243182C037E2A7123406E6CBF56A7E7DA15F25A8C73B8477AD5EB06E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download