70373b3022b1459d29b06f7f67e2d6e530f1237e93d29961e99f2cf300eccbea

Analysis

max time kernel
148s
max time network
139s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/08/2026, 14:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-08_b2172fc2acdb81f966c5ab1c5b128b8e_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260808-rmav1sybmd
SHA256 70373b3022b1459d29b06f7f67e2d6e530f1237e93d29961e99f2cf300eccbea
MD5 b2172fc2acdb81f966c5ab1c5b128b8e
SHA1 363d62d179e7040c258d7dfe1c347e0f9f32126f
SHA512 2f3c954d39ac583d66e7615d265bc78c667da1a450c1993aed865e788c0899881ad889ee4fa0993a4aae5285fb5428a29f809f345d56ce8b8ae2a20cb8829c41
SSDEEP 12288:Nb4bZudi79L5X8P83pDr8LxefN57pdu4aMqF+m1A:Nb4bcdkLF31r8LwfNH4Ca+m
TLSH
T16BA4F1243581C037E29705344BE6DBB6963A7AF14B22A8C73BE467BD2EB02D1D634357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4172	4CFD.tmp

Executes dropped EXE 1 IoCs

pid	Process
4172	4CFD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-08_b2172fc2acdb81f966c5ab1c5b128b8e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4CFD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1856 wrote to memory of 4172	1856	2026-08-08_b2172fc2acdb81f966c5ab1c5b128b8e_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-08_b2172fc2acdb81f966c5ab1c5b128b8e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-08_b2172fc2acdb81f966c5ab1c5b128b8e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1856
- C:\Users\Admin\AppData\Local\Temp\4CFD.tmp
  "C:\Users\Admin\AppData\Local\Temp\4CFD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-08_b2172fc2acdb81f966c5ab1c5b128b8e_elex_mafia_stealc_tofsee.exe 476C6332986EE538FEE68D708E8A9D1C37A4A92BC43D3FF250235E13E3CBE6938A993C80BD38AF0652AB62DE068394AAF67D626BA3990E492122E752BD2A97ED
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4CFD.tmp

Path C:\Users\Admin\AppData\Local\Temp\4CFD.tmp
Size 444KB
SHA256 496084bb15752c9ab50fd48ef754adc6fd26105aea566dd00aec4d11cc7856bf
MD5 95f29accc6f0e0a157dbdf333e22669a
SHA1 8e6288b7502e9d0a00a3396593e7e54e07cb7a18
SHA512 a2b972256c42d40e3aa0e2c01c9dae0485c658e9045c275450d76b18ff43a8b6e470bbbd564545c5608fc48feb52e377bfd59462c780a1e80da895d0b87f765a
SSDEEP 12288:Nb4bZudi79L44n5u02ejFO5zMhUfL09QA:Nb4bcdkLl5u6jM5pL
TLSH
T16CA4F1203181C037D29715384BE5CB76AA7E79A14B2268C73BD46B7D5EB43E2EA31347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download