ec7a6d23a65f0068d6d05afa745646080c29f3cd356b51449d68797eab740483

Analysis

max time kernel
148s
max time network
137s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/08/2026, 22:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-10_5cdd3e1c90c298c637d77d1081ae569b_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260810-2eejcazgja
SHA256 ec7a6d23a65f0068d6d05afa745646080c29f3cd356b51449d68797eab740483
MD5 5cdd3e1c90c298c637d77d1081ae569b
SHA1 ecd3334663425e599e1f9805d6d3a91d69662645
SHA512 1484a8a0d007d128cd5c70d752cf78800aaa4e18ca37b876f6da2e22fe27e9b23abd2d41efb813d35219689076c7bfae9214ce7c813d62ba0591eb351335f027
SSDEEP 12288:Z594+AcL4tBekiuKzErPUcXQ6ZPVULVIXCv5zwqQJI9AvOInl:BL4tBekiuVrPUcHZebQmI
TLSH
T18F94F1213482C037D19615384FE5C766297E7AB60B2668CB3BD01BBE5FA06D2D77834B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1684	83FB.tmp

Executes dropped EXE 1 IoCs

pid	Process
1684	83FB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-10_5cdd3e1c90c298c637d77d1081ae569b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	83FB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 1684	764	2026-08-10_5cdd3e1c90c298c637d77d1081ae569b_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-10_5cdd3e1c90c298c637d77d1081ae569b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-10_5cdd3e1c90c298c637d77d1081ae569b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\83FB.tmp
  "C:\Users\Admin\AppData\Local\Temp\83FB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-10_5cdd3e1c90c298c637d77d1081ae569b_elex_mafia_stealc_tofsee.exe FFB60D11CA750DEB5C04F7DB9BB2F024E36647518C1861D552E48671127BEC5DDB3A0E0973671541919B61417EFEF3DC837E842BE427E75B4FBDAD046693F261
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

83FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\83FB.tmp
Size 428KB
SHA256 5d595747c2faddc17dd4a53c95670ef968b4b86812b26a2660fdb827e8197853
MD5 00e77446485a113a981401001082402b
SHA1 d8266d6231d61d1625286c82ec38dc9e9cf6a216
SHA512 823009fa467164b6a128a6ff569907303b589adf146e629652e6de4024fbbbe2101cb58c1fbf0c36bfdf952181abb04862576c753821429835b50e711814853c
SSDEEP 12288:Z594+AcL4tBekiuKzErluZiEXTOL9inNUGMkiXZxS52GGF9l:BL4tBekiuVrY/ji9XZx/9
TLSH
T1AC94F0353681C033E2A716380BF5CB29567F79B50B26A8CB3BC417BA5EA42D1D63534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download