08a3d17eeaa9793d69da2e20f3f09d98c2a4d639eb97d46cf4a95303c7560405

Analysis

max time kernel
148s
max time network
142s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
09/08/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260809-x2t54athnc
SHA256 08a3d17eeaa9793d69da2e20f3f09d98c2a4d639eb97d46cf4a95303c7560405
MD5 f7e6410924f702f3747e65d53bd4d7db
SHA1 09a3bb3e4ea825591573cc867f1fdf865aaf3695
SHA512 0baed9961360ef760819b72ade1780103fa3c79f90a7720e1285e2a55d20a0d8ed7f1af763466d55ae829bdb6d8ee62d191db8bf3132c610db36cad9f06e63f7
SSDEEP 12288:bO4rfItL8HA/UDLDK+yQBsY0vQtOf8fnvJVIRc75UO:bO4rQtGA/UD/2nItO0fvTKcVUO
TLSH
T14FA4F1267A80C133E29302755FE6C7AA673E39710766A4C73B94027D2F616E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5400	232E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5400	232E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	232E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 5400	6020	2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Users\Admin\AppData\Local\Temp\232E.tmp
  "C:\Users\Admin\AppData\Local\Temp\232E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-09_f7e6410924f702f3747e65d53bd4d7db_elex_mafia_stealc_tofsee.exe D84E35F831EAD064E40E2A6E6BAF1171648B123804B804D929AA83BF3C125725BAC013767269A5B9C752139D07264F3C4A7D9772770FCF2E44B6741AF9C4EB80
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5400

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

232E.tmp

Path C:\Users\Admin\AppData\Local\Temp\232E.tmp
Size 479KB
SHA256 13a5b47fec64c865197d6166a485e3ca42ff2bab917814ff9f99df8b75983c9d
MD5 1339d1e8c3301d6cc37c7da019c8eb86
SHA1 8e94646a8d25e124143df19f2f0b92d3b7829d0f
SHA512 c0bf1bc09dcea3c3a91b4edf52b8f605f03c5d6a7d1b9865dd478cfbe6941442f7c9ec29a6845e4128c19f32528133bc85222821183e99f9222d7e37bcd4411b
SSDEEP 12288:bO4rfItL8HAHWO6OxKeaH/tt4ssoKSRFcM75UO:bO4rQtGA2NONaft0oP/VUO
TLSH
T1F5A4F1297681C133D29301715BE6DBA9A73E79B44326A0C33B9447BE1F61AE1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download