614f614544f4c80e984f1f436f657182d7720d059cb1534e98ec0651de68bd4e

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 08:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_8fb40b2dca69b75012540b076d0f1ab7_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260802-j719psyckh
SHA256 614f614544f4c80e984f1f436f657182d7720d059cb1534e98ec0651de68bd4e
MD5 8fb40b2dca69b75012540b076d0f1ab7
SHA1 8e82d1eb4431e5af4d652f71a62e337bf849f007
SHA512 4137ae5d9cc819436f82b8661d4158827302f5f8f5f1f6a8f185d1007b59a588107949ede6ada373c46574adafc8e56317f8b29605458a1345d3fb177eb0c330
SSDEEP 12288:Nb4bZudi79LB1JZl0VhHXCidG7IopeYcCA0a:Nb4bcdkLB1Tl0DHSidG0opo5
TLSH
T181A4E0243192C033E2AB15344AE9C7B6663E7DA19F2269C73BD4376D6EB02D1DA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3192	3A9E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3192	3A9E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_8fb40b2dca69b75012540b076d0f1ab7_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3A9E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4112 wrote to memory of 3192	4112	2026-08-02_8fb40b2dca69b75012540b076d0f1ab7_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_8fb40b2dca69b75012540b076d0f1ab7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_8fb40b2dca69b75012540b076d0f1ab7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4112
- C:\Users\Admin\AppData\Local\Temp\3A9E.tmp
  "C:\Users\Admin\AppData\Local\Temp\3A9E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-02_8fb40b2dca69b75012540b076d0f1ab7_elex_mafia_stealc_tofsee.exe AB2F9B77B2BC497F80FBD0EC7421F9C74727880C96CEEECAA4456A94D87E73167FA36BB5E83DA2C4C0CD28459B9A231043AA6905F569009D75927060D358F84C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3A9E.tmp

Path C:\Users\Admin\AppData\Local\Temp\3A9E.tmp
Size 473KB
SHA256 d6fabf5d9615222e1f8d02b0422e8c9ab6ef53595e0149d824cea13bc7881d39
MD5 3d7e9b1b75d0cc77ca87600377afe2a1
SHA1 f60d8e973f49e3a1f2022ed580ca6f0466f84253
SHA512 4fe0e3765bfde6482a310a7d5bbef1877f1e4ec9d98907e37d9ecb119129117c93ae4b9eb3c32977edbf900dcb0f548853d35dda9c863aa3cab364f605c7f5d0
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStgekAFaMCUq5MYBQMzajZqnHmvn0NkSfgdj+:Nb4bZudi79LGhYyMzKZl5Sfg+yNOiA0a
TLSH
T17CA4D0243182C037E1AB06354BE6CBB5553E7DA14F6168DB3B907B6E2EB02E1D634357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download