82a617053302e59fc6d07f7b3eb0f7daf74e7751b95203afeecb7c162491fba9

Analysis

max time kernel
150s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 05:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_e999e3ca223449fab067b2434a3b3077_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260804-fn33eadc89
SHA256 82a617053302e59fc6d07f7b3eb0f7daf74e7751b95203afeecb7c162491fba9
MD5 e999e3ca223449fab067b2434a3b3077
SHA1 38eb7571e76011d919cd644187fc0c01431a9855
SHA512 2bc9a76d4f132f4206cf1e78571ff13690e9e1c79371abbeb1a7fed5f483925681d442cd40833d85117907217ec6784413b2fbd83669125df1a2eb898a525b8c
SSDEEP 12288:Nb4bZudi79LXwRsA5qXifgIVMWQfr+invDA0a:Nb4bcdkLXg61I0+Ae
TLSH
T141A4E0243582C037E267163446E9DBF6663A7DB14F25A8C73BA07B6D5EB02E1DA30317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2272	D1FC.tmp

Executes dropped EXE 1 IoCs

pid	Process
2272	D1FC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_e999e3ca223449fab067b2434a3b3077_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D1FC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2944 wrote to memory of 2272	2944	2026-08-04_e999e3ca223449fab067b2434a3b3077_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-04_e999e3ca223449fab067b2434a3b3077_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_e999e3ca223449fab067b2434a3b3077_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2944
- C:\Users\Admin\AppData\Local\Temp\D1FC.tmp
  "C:\Users\Admin\AppData\Local\Temp\D1FC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-04_e999e3ca223449fab067b2434a3b3077_elex_mafia_stealc_tofsee.exe 4730B11834C05C8727F22E835EE7E6465A0CFD224A92490D40FC5DC9E7F03FB8298935DEAEEB79C850471B50434E1CB23C570607289A431A71D6D9C44308B6AE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D1FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\D1FC.tmp
Size 473KB
SHA256 364a38754ed11756ea8f2af917e4bb42269aa6280909bdd8ed1ad9f0bccfce16
MD5 7b0deba704079590818660d395932d2f
SHA1 8fe27248af79b2925fbe94a91b98d537140fddd4
SHA512 e58315bd465e17d705670c539467e35243e42eccc33ea544bd363157423c60a38d821ac09773d55d93dae301ec4c15285ec91fd6203a638537854a3ef2339560
SSDEEP 12288:Nb4bZudi79LQ2QMzJ5De/jxtYtSAJ9+gjtIA0a:Nb4bcdkLB5De/ltQJ9+gt
TLSH
T182A4E1143182C037E1A705344AE6D7F6693E7DA19F62A8C73B9077AD6EB02E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download