7137e1126f393d3ae1f86ba598d9c75bf9c9b19cb0053026af37e9e5933a5c46

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 23:36

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_d56b0f28cea9220dd6da8cb8403369d8_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260802-3ly21atend
SHA256 7137e1126f393d3ae1f86ba598d9c75bf9c9b19cb0053026af37e9e5933a5c46
MD5 d56b0f28cea9220dd6da8cb8403369d8
SHA1 7d5d61d6459bf6946d756a1c945f4bf5f70a02b9
SHA512 6961cd490bb16bfcd232b61c22556120e6d0d90558a5aa85d7234408c55cc2c0c588d8314c9c4a7281480ebbdd733d7474966ccdc143ea2207eee27b8ba40b4a
SSDEEP 12288:aO4rfItL8HRlYwPZpI9k+KM3f7CJW7K9wlsDpVFd:aO4rQtGRi99krHW+9wlsDpVFd
TLSH
T1F4A4F035B6818133D29302750BE6D7EAAA3E74B5033694C37BD4026E1F61BE1E77A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4252	F548.tmp

Executes dropped EXE 1 IoCs

pid	Process
4252	F548.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_d56b0f28cea9220dd6da8cb8403369d8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F548.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2512 wrote to memory of 4252	2512	2026-08-02_d56b0f28cea9220dd6da8cb8403369d8_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_d56b0f28cea9220dd6da8cb8403369d8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_d56b0f28cea9220dd6da8cb8403369d8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2512
- C:\Users\Admin\AppData\Local\Temp\F548.tmp
  "C:\Users\Admin\AppData\Local\Temp\F548.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-02_d56b0f28cea9220dd6da8cb8403369d8_elex_mafia_stealc_tofsee.exe CF5E0B8C238ED1087F3EA69BEBB0D442B75BF50F3BF81608E78BEF51E41CACB24511F58C1041AD42307AA48F3B6CE2926747B8D19A635D0F51AB2689A432AFF4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F548.tmp

Path C:\Users\Admin\AppData\Local\Temp\F548.tmp
Size 476KB
SHA256 49440c0b540c7fda7c62667a5cf657b781e52b35eddac99eb73940dcb3d3a5bf
MD5 6aa02588325a5bf598329c88740ede46
SHA1 7cf3e7cb1f20579ff2255f70e5f02194fae1ba8a
SHA512 96e3ac6676e505c54be05e2bc0e3fb231a7052b76da83b539eb14508f6674788b77fbedba2ffcf508c219ba248744664bb25f42743c5b5545469ff482420aeaa
SSDEEP 12288:aO4rfItL8HR1hT85HJFPIFDo+eIkmOf7K9wlsDpVFd:aO4rQtGR1hT8NTgOlxzf+9wlsDpVFd
TLSH
T129A4F129BA85C233D29302740BE6DBA6663E78715326A4C37BD4037D1F60AE1D77A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download