c50ffb856b5dd1e6ad6aad5a8015a1339c9cbaa4742d459495ee16fe98902e38

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/08/2026, 16:25

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-02_e4ec69f163fa268d7edf7bd11af72fda_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260802-tw9rtacn4z
SHA256 c50ffb856b5dd1e6ad6aad5a8015a1339c9cbaa4742d459495ee16fe98902e38
MD5 e4ec69f163fa268d7edf7bd11af72fda
SHA1 a4fca26d35334ad4fbb7eea4fe7c2a487f81fcb4
SHA512 e9ba92d1cd180874f7c44b2d7a1f53cf22f5233b3666c072d3b4c111c50c8e3fc720ef16f73298c1c7ee444cc16495cd5168b3715d3809f02b9d50adc2f082dd
SSDEEP 12288:Wq4w/ekieZgU6+daDdnraD/0XVAq+ppBl:Wq4w/ekieH6+Ednrug+l
TLSH
T1AC94E0317586C036E1A306348BE5DBBA693A7D610B35A4CB37D42BAE6E746C1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2736	9418.tmp

Executes dropped EXE 1 IoCs

pid	Process
2736	9418.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-02_e4ec69f163fa268d7edf7bd11af72fda_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9418.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4432 wrote to memory of 2736	4432	2026-08-02_e4ec69f163fa268d7edf7bd11af72fda_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-02_e4ec69f163fa268d7edf7bd11af72fda_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-02_e4ec69f163fa268d7edf7bd11af72fda_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4432
- C:\Users\Admin\AppData\Local\Temp\9418.tmp
  "C:\Users\Admin\AppData\Local\Temp\9418.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-02_e4ec69f163fa268d7edf7bd11af72fda_elex_mafia_stealc_tofsee.exe B2FF25DB7F5BB347EBC47BFAE66AFD5C76E7AA1B1A1AD1F997A8AB79AE42D582CE41CFE8B94D3E1FA77C14BC57B2FB6D5599901FDE68F3D4779FDC2CF89F3D26
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2736

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9418.tmp

Path C:\Users\Admin\AppData\Local\Temp\9418.tmp
Size 414KB
SHA256 00b18a669bf718c6962039cc825cbdf167dda92b8a16302f675623f413c25eb7
MD5 462052887a0d25dbb7915ef9faa71b74
SHA1 1d91bf1714bd4ba59ef85016b3b7616a5d4af0dc
SHA512 8e38673f3393fbee74117744406bf57a09aef5525ade01e24a4dbd42cc9986dea7c5736f46aa22e5f61ee52839b84d59b355374d40910ddb9c3da4a49c743a17
SSDEEP 12288:Wq4w/ekieZgU6gK2oxFia6WqCjAUjrOjl:Wq4w/ekieH6gsF9YUjr2
TLSH
T11694E0213586C037E15716358BF5DB6A693A7C614B36B4C737D42BAA6E706C2EB30307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download