bbc857ff0738a1a1e77a64c488fb3c31822b341a0b35a0d68612acd97ee52ead

Analysis

max time kernel
148s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 05:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_b72f5743bed7677572be6364a6238826_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260811-fm4mjsce82
SHA256 bbc857ff0738a1a1e77a64c488fb3c31822b341a0b35a0d68612acd97ee52ead
MD5 b72f5743bed7677572be6364a6238826
SHA1 619156198841ba9b73522c5229bf9a609378bd65
SHA512 6edad8eb0a689816bcc96112a648288f2f1802f9936bfdd1f344529c56ac8d968a3246e91f74b507e0aa4b70560f0e3940bdb302687aa377437a99510d4ff572
SSDEEP 12288:3O4rfItL8HPY+jthahZvj1cWji7rKxUYXhW:3O4rQtGPYvvBcgi3KxUYXhW
TLSH
T17CB4F12A72418233D29302715BE6DADAB63E78B51326E4C337D8427D1F61AE1D73A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1984	8BEA.tmp

Executes dropped EXE 1 IoCs

pid	Process
1984	8BEA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_b72f5743bed7677572be6364a6238826_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8BEA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1468 wrote to memory of 1984	1468	2026-08-11_b72f5743bed7677572be6364a6238826_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-11_b72f5743bed7677572be6364a6238826_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_b72f5743bed7677572be6364a6238826_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1468
- C:\Users\Admin\AppData\Local\Temp\8BEA.tmp
  "C:\Users\Admin\AppData\Local\Temp\8BEA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-11_b72f5743bed7677572be6364a6238826_elex_mafia_stealc_tofsee.exe 41F6D83D5AA5F36D8897A825791036C0A240352F473D34FD3FB850E4DF1308E296AD4D92CC3590918CA298B8F1FE21FB98357EA9E88E2195EC2CC82AF025EA66
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1984

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8BEA.tmp

Path C:\Users\Admin\AppData\Local\Temp\8BEA.tmp
Size 486KB
SHA256 06fa63b360b800d555a9a26d1d03a4837735662182a4aed77ffc9401705d7e7f
MD5 14666c3722e36e35d1ceaeee1121cd78
SHA1 abe70f19440e2be533b812137d0d04fae40a0b7d
SHA512 100517e8f87aa2399b692b1a4b94641ffb422dc116f1689f20213529039f9927814730f31da560072ea7f8f96da0018bb5b9c13e4cf14b1f1adc039cd32cee07
SSDEEP 12288:3O4rfItL8HPnDlbgPPX0LWSr+7NpQ9dXFM7rKxUYXhW:3O4rQtGP5bgPPX0LDINAy3KxUYXhW
TLSH
T199B4F12976818233D2C202750BDBDB96A63E74B5137694C337D8027D1FA26E1D77A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download