ad759edee8e48c1c30660c6f1fb069a4b3af6e0db6e9500707ae6d70c0884950

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 03:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_386b4a1dd07a6020e69bab71e35a52d7_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260802-dvm9escm5w
SHA256 ad759edee8e48c1c30660c6f1fb069a4b3af6e0db6e9500707ae6d70c0884950
MD5 386b4a1dd07a6020e69bab71e35a52d7
SHA1 5962caaf68521fbfb216bd544f961798b00fa634
SHA512 d69847879794ab00688a71a3f295cb61506045ed2c6bf3149531e164506cd83b7911d1cea6225990cdcd47b5e92aa6b6543a744c1a8aa39d5d0cbe2b58ea6d28
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvi6ECqn1J1yFAKGtIqKNVhVlZ3pEM6I00y3T:Ci4g+yU+0pAiv+06qn8FAKgMtlZZSwkn
TLSH
T10694F1213492C033E19B05354BE5C7A6657E78B54B26A4CB7BD40BAE7EA03E1D37834B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4396	9F15.tmp

Executes dropped EXE 1 IoCs

pid	Process
4396	9F15.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9F15.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_386b4a1dd07a6020e69bab71e35a52d7_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2496 wrote to memory of 4396	2496	2026-08-02_386b4a1dd07a6020e69bab71e35a52d7_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-08-02_386b4a1dd07a6020e69bab71e35a52d7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_386b4a1dd07a6020e69bab71e35a52d7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2496
- C:\Users\Admin\AppData\Local\Temp\9F15.tmp
  "C:\Users\Admin\AppData\Local\Temp\9F15.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-02_386b4a1dd07a6020e69bab71e35a52d7_elex_mafia_stealc_tofsee.exe 3D551F0194A2DCB4F8E73B6AD86B63E96746F72AAF53AFA5E374E7A804A4324BAF1B662E2866D0CAEE1E40BDE3C2945371A52F6F3B1DCEE2690DFCCFA268F15B
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9F15.tmp

Path C:\Users\Admin\AppData\Local\Temp\9F15.tmp
Size 433KB
SHA256 e91e855d357f05685d87c5b472fe4a5155c5c14e62c02c99adc24e9c775615c6
MD5 5d1ed5d4e4493ea1b8485723a951effe
SHA1 008deeda37c312e7397b2b7cf37d247af2fba247
SHA512 e94ff415b25f443a126428139b2d4d8e0a3174d9091ea3a46ae2d07623a19c9f0148e456450eaa45ec9697b5aedb462cc258c7a9172db9ccbb0e48226337bc93
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvuN37wN31jhgrCjhSjCkFJea9RbJEcZknobB:Ci4g+yU+0pAiv+MNPySj3JNNEMkQp3Pn
TLSH
T1BB94E0313592C033E2A706354BF5D76A657E79A20B26A8CB3BD40B7E2E642D1E335347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download