13d3fe2526a61c5a1d15b923ca6883faf0c0c13ac96bd0cf9b3a3c82a8ad6170

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 05:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_bb28021a93bdd232bbf900c8efe3b56c_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260809-fnhrgatzd1
SHA256 13d3fe2526a61c5a1d15b923ca6883faf0c0c13ac96bd0cf9b3a3c82a8ad6170
MD5 bb28021a93bdd232bbf900c8efe3b56c
SHA1 78793853ed0adca62962be41a0f1c01e663e33aa
SHA512 0a6e9c8ecf538da0da3c69dd59115a8d984ceb6e27180b6606be14b66b2c1fd1547728a10581b6343637005d0cc6a5859e1da97e737b963510886560dcd33afe
SSDEEP 12288:Nb4bZudi79L8nwxFXQLKhSHE9lZ1LiXA0a:Nb4bcdkL8nwxFXQuhZ9/BP
TLSH
T117A4E0207581C037E2A712350BE6CBB6667A3D615F61A8C73BE4376C6EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
940	285E.tmp

Executes dropped EXE 1 IoCs

pid	Process
940	285E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	285E.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_bb28021a93bdd232bbf900c8efe3b56c_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2200 wrote to memory of 940	2200	2026-08-09_bb28021a93bdd232bbf900c8efe3b56c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_bb28021a93bdd232bbf900c8efe3b56c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_bb28021a93bdd232bbf900c8efe3b56c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2200
- C:\Users\Admin\AppData\Local\Temp\285E.tmp
  "C:\Users\Admin\AppData\Local\Temp\285E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-09_bb28021a93bdd232bbf900c8efe3b56c_elex_mafia_stealc_tofsee.exe 2C149ED9C110DE8802DBEE2949B978525F36CCEF3E8B919CBF1CDCA17BE019F0633DB2808827F21877647B7FA4705484EB41E55434B87FF416BEEC3CA807BC13
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:940

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

285E.tmp

Path C:\Users\Admin\AppData\Local\Temp\285E.tmp
Size 473KB
SHA256 efef4e856d5241da498dc9e371e7b4aa29e5b022c103762313443cade32fc7f3
MD5 25188dfd496791a8b48d0e21495298f0
SHA1 77cfd3385b4287f4d911c09c7b03afbbcac417ea
SHA512 a7e146d216998d842c8dbcc978d18bfb75b198e69085a60b249c5e9f21943027c5a547738c7a257ffe1c1435206cd281f6ec67f560f9965b84a906c50cc04bde
SSDEEP 12288:Nb4bZudi79LKbcbczHCvZqXGMon2nXi1h7SL/aeA0a:Nb4bcdkL5YzyTMwJ6/K
TLSH
T1A6A4E0143582C037E2A716394BE6C7B5A57A7DA04F2268C73BE03BAD5EB02E1D635317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download