337cefcef5d2a6a4a52ce0d674b86f03168336747512a309f6f7362262e4edb5

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/08/2026, 07:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-04_351e77281f832ac5605001655543a355_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260804-jk812afe34
SHA256 337cefcef5d2a6a4a52ce0d674b86f03168336747512a309f6f7362262e4edb5
MD5 351e77281f832ac5605001655543a355
SHA1 3cbc0b48c6a5a390598dfd4ea8bdfbc27bc0a2d0
SHA512 e41cf934776aec019edd445cc8986efa0810b823e52cfedb7d9e7a3c7295ebb3ecafce12e1b614d232401a63696d74d60b686d07e0f4b21037aff6241394515b
SSDEEP 12288:Wq4w/ekieZgU6zJjG3YgKyuxroBbfILzkalMa:Wq4w/ekieH6liopxUJILzkaP
TLSH
T176A4DF217582C037E1A712348AA5CBE9667A7D604F72A4CB3BC437AE6E746D1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2072	FE4.tmp

Executes dropped EXE 1 IoCs

pid	Process
2072	FE4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-04_351e77281f832ac5605001655543a355_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FE4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3600 wrote to memory of 2072	3600	2026-08-04_351e77281f832ac5605001655543a355_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-04_351e77281f832ac5605001655543a355_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-04_351e77281f832ac5605001655543a355_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3600
- C:\Users\Admin\AppData\Local\Temp\FE4.tmp
  "C:\Users\Admin\AppData\Local\Temp\FE4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-04_351e77281f832ac5605001655543a355_elex_mafia_stealc_tofsee.exe 83487D43FC3F48D174C14E021ACBE3E6CBB8D57A34FFAE86EE5B3143CE1D64969DD5ECB343EE3090F9D1032705816573732B51784F3B181A2FE9F07BB1A897DF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FE4.tmp

Path C:\Users\Admin\AppData\Local\Temp\FE4.tmp
Size 443KB
SHA256 a7876b6d1f6254e4ac5546733cbf7f6541e2d6e20d20d8795fcd2cd89a94fe97
MD5 596b675d8fee47b51caad1e7734f4f61
SHA1 3faefb95b7ab98ddab6859efd34499b37bbff10b
SHA512 6f31eae25f3f801e000f4f8bd7ab0a6a0625c8dc0652e5b189eb00c5afb8ec55280371d519ecd03662ad42519fcd9e9e3004c65fb5e8f3cd6e261c62015cd5a7
SSDEEP 12288:Wq4w/ekieZgU60fmtmS74nLCKDVdDcfChxCmkPxZlMa:Wq4w/ekieH60qT4uKD/Qss3jP
TLSH
T172A4E0217182C037E2A702394AA5CBE9167A7D605F76A4C73BD437AEAE345D1DB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download