7442723d724ee00a2a17a754b1fb90fa9ab85151d889f20a68c282bbc2c9c0cd

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 21:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_9457ddb492cbaf117806fe182e52b187_elex_mafia_stealc_tofsee.exe
Size 492KB
Sample260802-1cmaqsga93
SHA256 7442723d724ee00a2a17a754b1fb90fa9ab85151d889f20a68c282bbc2c9c0cd
MD5 9457ddb492cbaf117806fe182e52b187
SHA1 86080003223fa1128929d13e74a6c8a385a37670
SHA512 0bfeebe5c384f75ec346833eb32a8b55754c25462326ca6ec4fd45384c157a78c3d38c7ed259be8cca220e62ba53961d7bb79d114c3e071e6cd9701b76a3fd54
SSDEEP 6144:A9EyS4oMxIkjxcWqHtg88HAReMGmb/r+Cz7sRh+gFISpUUQj4hG75UNkv:AO4rfItL8HACmnxETFFBCIG75UA
TLSH
T1CFB4E03A72818233D2D302711BE6D7A6A73E7875132694C73BD8426D2F616E1C77638B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1196	37A0.tmp

Executes dropped EXE 1 IoCs

pid	Process
1196	37A0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_9457ddb492cbaf117806fe182e52b187_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37A0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2836 wrote to memory of 1196	2836	2026-08-02_9457ddb492cbaf117806fe182e52b187_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_9457ddb492cbaf117806fe182e52b187_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_9457ddb492cbaf117806fe182e52b187_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2836
- C:\Users\Admin\AppData\Local\Temp\37A0.tmp
  "C:\Users\Admin\AppData\Local\Temp\37A0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-02_9457ddb492cbaf117806fe182e52b187_elex_mafia_stealc_tofsee.exe D808FF22062A7DB9B041D8A2DEED08313957CAF3AB7C2103D4F8E6DE2B87E640C36C7FD77536EF833085BC355147394A038B09F8EA6296483FB0C136C77B25CD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1196

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\37A0.tmp
Size 492KB
SHA256 a6e879782a8d0a6a4d914477fd3059ba9611bdde809f435ff7b417780c17de2b
MD5 fd41cb49f14fc2d45e294625f2697ae2
SHA1 c7b7181616de24f0a797cfe965aa9b2e1159b344
SHA512 d72a520f969f688e4e3c4e9aab8dfdb17cc4ca959f3ebd519b229f483b5f019588a93d50cd807e7596c9791d34b139a3d86dab44b06b0ff8618514ddb319b682
SSDEEP 6144:A9EyS4oMxIkjxcWqHtg88HARelY4vMloofV86dDUhp6TsefuLcsRTtRoHje5Er1L:AO4rfItL8HA6zf6pUzFzhRoayr175UA
TLSH
T189B4E12A76818233D29302B55BDAD796AB3E7970132694C33B98017D1F75BD1D33A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download