078c13530f5b4ba9aff9c77e5c32c6822a0c1e494d2244c0486dc45949af06fc

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 21:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_95dbd8252e9c3569129d9e52dfca322c_elex_mafia_stealc_tofsee.exe
Size 492KB
Sample260802-1cd95agj6x
SHA256 078c13530f5b4ba9aff9c77e5c32c6822a0c1e494d2244c0486dc45949af06fc
MD5 95dbd8252e9c3569129d9e52dfca322c
SHA1 fb951c32d5ae5e50e0abab68d2ad613006572e77
SHA512 edc2f42fa196a64faab0ef3295eb7c3567da6d7a43c3bae3aa277c543cfaeeec8ea60e13a8d458a0cba6b1423043e2beec932f324d196582627b1375739ba9b7
SSDEEP 12288:AO4rfItL8HAtEr4cFGNc19P3Pg/lyRagJyenU75UA:AO4rQtGAtEkNi9PPg/IcgEenUVUA
TLSH
T1A4B4F13A76818133E39302711BEADB99AB3E7571132694C37BD4027D1F61AE1D37A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3860	F39.tmp

Executes dropped EXE 1 IoCs

pid	Process
3860	F39.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_95dbd8252e9c3569129d9e52dfca322c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F39.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2248 wrote to memory of 3860	2248	2026-08-02_95dbd8252e9c3569129d9e52dfca322c_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-02_95dbd8252e9c3569129d9e52dfca322c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_95dbd8252e9c3569129d9e52dfca322c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2248
- C:\Users\Admin\AppData\Local\Temp\F39.tmp
  "C:\Users\Admin\AppData\Local\Temp\F39.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-02_95dbd8252e9c3569129d9e52dfca322c_elex_mafia_stealc_tofsee.exe 8B08D6A8FF28A491A13F5706A80E0A848AC558956DCF0E8F7D39440F15E40555BD8B9C2FE64EB2A19DFF47DDB48D7A02811243E27D2E471DC84317434C0742FA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F39.tmp

Path C:\Users\Admin\AppData\Local\Temp\F39.tmp
Size 492KB
SHA256 36653debc9e22310b37022c3f98f5a2005b7569d8fc5194bce2fe16f94ca1b1f
MD5 313356aab056cf9aa17042b6468b270b
SHA1 eb2d2b39c1597c978dc9d19e46fd55f377d25ea4
SHA512 60db79ad2572785e3fc164d3d02bd0b3c77d6e918b6567e071244684a85c7ccca819b45f5b945d3503d2fb4fda2e8cdd96635d8f0574216be5768ec93bfe993e
SSDEEP 12288:AO4rfItL8HAbR0/7efWeLMPgBaZ3M7fsC75UA:AO4rQtGAbSk5MYsgsCVUA
TLSH
T1B5B4E12A7641C233D2E302B11BE6DB96A63EB5740726A4C37B98427D1F61BE0D376347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download