8df358c7d7eae35c5010f03c493554a80e25008193cc8d31c3ca19610ab0581a

Analysis

max time kernel
148s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 01:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-01_0eff1dbcca06f2fa152e3caa1bca6552_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260802-bqgvqsbc84
SHA256 8df358c7d7eae35c5010f03c493554a80e25008193cc8d31c3ca19610ab0581a
MD5 0eff1dbcca06f2fa152e3caa1bca6552
SHA1 6be7116db608b1e2b55d294661804ded2e171def
SHA512 f40da441bedfa32d269555b01d393067442179760938b8d0d0b5fb61bc50f1940c16140af89918d1348dfa8e8e48060c83a2e65d0c1b7a403a2d68b917b45f6f
SSDEEP 12288:aO4rfItL8HRKYLfr8UNmCp6V8lX7K9wlsDpVFd:aO4rQtGRKYTCCp68X+9wlsDpVFd
TLSH
T130A4E12A7682C133D2D302351BE6CB96BA3E79710376A4C377D4026E1FA16E1D37935A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4180	6BFF.tmp

Executes dropped EXE 1 IoCs

pid	Process
4180	6BFF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-01_0eff1dbcca06f2fa152e3caa1bca6552_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6BFF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4860 wrote to memory of 4180	4860	2026-08-01_0eff1dbcca06f2fa152e3caa1bca6552_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-01_0eff1dbcca06f2fa152e3caa1bca6552_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-01_0eff1dbcca06f2fa152e3caa1bca6552_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4860
- C:\Users\Admin\AppData\Local\Temp\6BFF.tmp
  "C:\Users\Admin\AppData\Local\Temp\6BFF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-01_0eff1dbcca06f2fa152e3caa1bca6552_elex_mafia_stealc_tofsee.exe 30F5D98D8D0004709777D8748A1A9EE56F127E73A92C9DFA239B77FE315E4B988857515F9262BB1F3089B7328E9A1718F0C7542D9F6E7FB3C79BA77467A35584
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4180

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6BFF.tmp

Path C:\Users\Admin\AppData\Local\Temp\6BFF.tmp
Size 476KB
SHA256 c467bea9ebf4db2b3bf6debf500f9daedf23a9a64a05c5f5212656e22de56456
MD5 1b93c5f076214cba625d1189c017f7e4
SHA1 668573780ced9a6a20821e71c879d5811e449761
SHA512 707c2e54ec987e3f2aaedd64233830526edc559c03faf3b9d623cad3efd6901ad56dce5c40c578c48af31d9f58270443f54f4b1d76ddfda6950b34e6742ad052
SSDEEP 12288:aO4rfItL8HRteD/uKjYM6zotlU7K9wlsDpVFd:aO4rQtGRADuEbU+9wlsDpVFd
TLSH
T111A4F12A7781C233D28301754BE6DBA6AA3E79B4172694C32BD4433D2F61AE1D739347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download