bf04a3008ce9bcc427589c2cc1bd21396f09a721b9830268d9780c470a55c5db

Analysis

max time kernel
148s
max time network
117s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/08/2026, 19:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-05_14a4347ec5441b49eea2927c8c5bf4fc_elex_mafia_stealc_tofsee.exe
Size 416KB
Sample260805-xwtblsen5s
SHA256 bf04a3008ce9bcc427589c2cc1bd21396f09a721b9830268d9780c470a55c5db
MD5 14a4347ec5441b49eea2927c8c5bf4fc
SHA1 f9064367477c924d80a4ba56900fcd61a3d535f1
SHA512 06089efb0a5bcc3c92629ffaf7dfa3379f1aa58114a555e0e6ea5e27da4d34ae431d3f6bb400a6881bc4bf0b9a2f8bb0217739c8eaf079a54ba72eceba90145a
SSDEEP 12288:Wq4w/ekieZgU6Qk9oIc5HngN4szkRY7Rl:Wq4w/ekieH6vULGt
TLSH
T1FD94E1343196C036E1A702348AE5DB656A3ABD714B36E8C737D427AE2E702D1DB3530B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5264	2188.tmp

Executes dropped EXE 1 IoCs

pid	Process
5264	2188.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-05_14a4347ec5441b49eea2927c8c5bf4fc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2188.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2672 wrote to memory of 5264	2672	2026-08-05_14a4347ec5441b49eea2927c8c5bf4fc_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-05_14a4347ec5441b49eea2927c8c5bf4fc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-05_14a4347ec5441b49eea2927c8c5bf4fc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672
- C:\Users\Admin\AppData\Local\Temp\2188.tmp
  "C:\Users\Admin\AppData\Local\Temp\2188.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-05_14a4347ec5441b49eea2927c8c5bf4fc_elex_mafia_stealc_tofsee.exe D0BD7230CC3DE14C41428768F7B312BCE5FCF737F50CA8EDDFC9266CB05BB0A9EAA751BF4B3882CDDB287283E0A01BCF80477611FAEF77CDD87D58878EEFC0CC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2188.tmp

Path C:\Users\Admin\AppData\Local\Temp\2188.tmp
Size 416KB
SHA256 b67456750636b3922bbc8d2393f1fcd1b3c2f802927436908cea7008faf4fd82
MD5 60b106f3c37bd371bb760804d5db4cc9
SHA1 5f2b78382602b64d0d43440f4dcb80c93d7bd600
SHA512 a89876c6af22d79405c4903fca8226b0e3867aab19eba6a3da82e408fa6858481648f36d28834d97eb7b0c76fb0f9eb4385580603cf2f2d2700ff3b3bc6f25d9
SSDEEP 12288:Wq4w/ekieZgU65VIeNH/PZECVv6oZZU5dsI9Mml:Wq4w/ekieH65V3Z2P5dh
TLSH
T16494E0317486C03BE69716348BE5DB69597DBDA54B32A4C73BD02BAA5E702C1CB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download