74e6e26849833b9678177da38e31d7e45cbe3982a8054bc0094bcf8aa3c9d581

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 21:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_03e448b4072b565ad084da4850d4256a_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260805-1pmf9sxcph
SHA256 74e6e26849833b9678177da38e31d7e45cbe3982a8054bc0094bcf8aa3c9d581
MD5 03e448b4072b565ad084da4850d4256a
SHA1 636669d56f81b7448d6460f6ad623be080a17829
SHA512 7be2fd1e6dd77908fb5ea1ebef2b063b07b68b959c1162e346e6685c1d5019280fccd817a92c2e1c265d246b64657178c1b7bafdbdfbc23c86317c46c92e88c4
SSDEEP 12288:Nb4bZudi79LZmyyV5016HwA/HSPbhWS6A0a:Nb4bcdkLfyVS6Hfq7
TLSH
T13FA4E0203582C037D29712344AE5C7B5A67E7DA15F2168CB3BD07BAD6EB02E1DA3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1496	6845.tmp

Executes dropped EXE 1 IoCs

pid	Process
1496	6845.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6845.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_03e448b4072b565ad084da4850d4256a_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5736 wrote to memory of 1496	5736	2026-08-05_03e448b4072b565ad084da4850d4256a_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_03e448b4072b565ad084da4850d4256a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_03e448b4072b565ad084da4850d4256a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5736
- C:\Users\Admin\AppData\Local\Temp\6845.tmp
  "C:\Users\Admin\AppData\Local\Temp\6845.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-05_03e448b4072b565ad084da4850d4256a_elex_mafia_stealc_tofsee.exe 452DFFDACE96155B04301DD0DE5687CF7142BA134A58272B9BB856D66E477DDC53711816C8C53A16769E221B14B593F1C09DC81039C7D6931ABFCE5B3BC578FC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1496

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6845.tmp

Path C:\Users\Admin\AppData\Local\Temp\6845.tmp
Size 473KB
SHA256 11ce3cdd5622a1f898e68ffa106bd8c0e3327c9a6ae370049bd92602f0783938
MD5 9a4802d6a49fe44e0a8ec3ecfcf8ea0d
SHA1 5c2be6da606318310c8f856ec1dd1491caeb9a69
SHA512 750b1893588a4f56a7834b06b26a4768f2ab7cb87f985fedf291f6b347c498fb0b91dd36d8d49332d03ba69cd260c804ad4841f0c23cadc96dcdd7372c494e1b
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStVmhytOEO3/uBrkkJer820DE7rCPi44A24sg:Nb4bZudi79LimiBMo2Ky9NrA0a
TLSH
T177A4E0243682C037E1AB02340BE6C7A5653E7DA15F2265CB3BD47BAD5EB02E1DA31357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download