3e64ac6ba0e805aa9fc1d1223e13366776396c6804efcdf0715afa23389938b7

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 07:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260731-hynftaef44
SHA256 3e64ac6ba0e805aa9fc1d1223e13366776396c6804efcdf0715afa23389938b7
MD5 a5e99442f2ea9b41cfef0e88bd2b5c01
SHA1 133e5cc646f9271e365ea6e492f1f43a951b0480
SHA512 0c059ebae271f970e2e50927ed3723599d405e24daa9aa0772d3bf6ff2c3fd405b07487aec3855d413bb3a855ef128af623fbae3eca346c46ffb23f57755940e
SSDEEP 12288:fd4x+ePixnXQj6ygRN9apts1VqvbyzDVNY1uwP:fd4x+ePixAj6ygROptfyoE
TLSH
T1D594E0313686C036E1E305348AE1DB66697A7DA05736A8C73BD43BAA6F702C1D73534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1928	E97C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1928	E97C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E97C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1256 wrote to memory of 1928	1256	2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1256
- C:\Users\Admin\AppData\Local\Temp\E97C.tmp
  "C:\Users\Admin\AppData\Local\Temp\E97C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-31_a5e99442f2ea9b41cfef0e88bd2b5c01_elex_mafia_stealc_tofsee.exe 6DEE06C0042A3E3E5D6BB33706E12414D664B314193A5A1AC1D1EA1B179B2116EFDAB065B6BFBDF433556F3BD3BEB858E27F6BA82A56BFE6275E64BE59813639
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1928

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E97C.tmp

Path C:\Users\Admin\AppData\Local\Temp\E97C.tmp
Size 435KB
SHA256 938e7bd54d94a4f81e5912c13d95629d02775978fdec1a58ecb0b40a91819f17
MD5 c3eca8669a9663f04a73b3ac4d1eaeaf
SHA1 43f13639d0920c6b4aa6364743af3e3b9a76f303
SHA512 54b7aa4d3b62491ae396f5c151aa2326e43e00edaeace8893d4a6272c17bfc01b22eef0379124cd4a04677cbf57165b228525607ec7e1d05e92fbd887a3c91cd
SSDEEP 12288:fd4x+ePixnXQjIEjjADI0t1g/7krY+j9BuPgjckSwP:fd4x+ePixAjDCbMSsojcZ
TLSH
T12394E0213586C03BE1A705354AE5CB6A593E7D700B32A8C77BD43BAA6E752C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download