7e7f4d2614d4dd50ecfa041f91968d6f95748ae96e1bbc2d04c42d9ea98e827e

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/08/2026, 03:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-06_3d0dc8336c5f9437e577d5aa0a49a3b2_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260806-dnjmnascmd
SHA256 7e7f4d2614d4dd50ecfa041f91968d6f95748ae96e1bbc2d04c42d9ea98e827e
MD5 3d0dc8336c5f9437e577d5aa0a49a3b2
SHA1 a8b71c63a7babc17afafcefd4859bc3cf584340e
SHA512 976d2dd90a42c614d73f90cef633fe2d7546394e0c8ac315b8bd83725db789e01b4897e6cb93b5462e7c0371439a050b6376934f549cda84053677b960824272
SSDEEP 12288:Wq4w/ekieZgU6qGMyAvQEGK1V3Dsq5mlx:Wq4w/ekieH6uyVEv1hpmr
TLSH
T1FD94E0213586C03BE1A716358AE5CB7A193A7DB44B35A8C73BD427AE6E742D0DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2704	2E69.tmp

Executes dropped EXE 1 IoCs

pid	Process
2704	2E69.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-06_3d0dc8336c5f9437e577d5aa0a49a3b2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2E69.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 2704	2984	2026-08-06_3d0dc8336c5f9437e577d5aa0a49a3b2_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-06_3d0dc8336c5f9437e577d5aa0a49a3b2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-06_3d0dc8336c5f9437e577d5aa0a49a3b2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\2E69.tmp
  "C:\Users\Admin\AppData\Local\Temp\2E69.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-06_3d0dc8336c5f9437e577d5aa0a49a3b2_elex_mafia_stealc_tofsee.exe 287C23911B7B5B2F8905BD7B63F6E132FA7CABC3B11827DD97AD913E660563B681D7C9DBC77790B5DC3E4D9D980C2ED788C9162F4CD510EA27869C84E8D35EAF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2704

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2E69.tmp

Path C:\Users\Admin\AppData\Local\Temp\2E69.tmp
Size 414KB
SHA256 8f479e6f205c1a8044e2f9fbedb5fd673466f3878097de21b25208c24fc7dd70
MD5 69fae9c7153448ebf7939d0f3bc548c7
SHA1 a108314460c7d8a817cc8052c3356a9e64e53250
SHA512 200ede337613db3a24b4ac99ee4ff91f611f3ce1f7eb947509b5db56fc514c56c213c931443a6c20955232c98a3612545cdbbf07e38a41c99796c36417f3cf6c
SSDEEP 12288:Wq4w/ekieZgU6CriVDeMXRzHstTaBM8lx:Wq4w/ekieH6C+De4H+8r
TLSH
T12A94D0357686C036E1A706348BE5CB6A593E7D754B36A4C73B902BAE2E702D1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download