0b66353f1dd693fe832fb440cbc58ed41ae10c3e4b5744a525513c6f4ba33b00

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/08/2026, 10:42

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-12_d8ba7ea314b5cff29e06ee7232c2937b_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260812-mr16jsvcqa
SHA256 0b66353f1dd693fe832fb440cbc58ed41ae10c3e4b5744a525513c6f4ba33b00
MD5 d8ba7ea314b5cff29e06ee7232c2937b
SHA1 79e857ec1aeb240c7f0d6c93e1804458145680f7
SHA512 8696d374b3614ee7a93ac02ec594f08600cefbd3830cf3c3a2f2a88114452ecfe6280cd2887895a577a84de9bd0f2c0890513da00b16909ef2947b198b9be260
SSDEEP 12288:Z594+AcL4tBekiuKzEreNSBxBWFXYdsPxfxWaZSvfFAbl:BL4tBekiuVreNSBxBWFodExAC
TLSH
T10594E0313482C032D2A716344BE5C76A557E7AB15B2AB8C77B801BBE6F942E2D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4992	C970.tmp

Executes dropped EXE 1 IoCs

pid	Process
4992	C970.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-12_d8ba7ea314b5cff29e06ee7232c2937b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C970.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 124 wrote to memory of 4992	124	2026-08-12_d8ba7ea314b5cff29e06ee7232c2937b_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-12_d8ba7ea314b5cff29e06ee7232c2937b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-12_d8ba7ea314b5cff29e06ee7232c2937b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:124
- C:\Users\Admin\AppData\Local\Temp\C970.tmp
  "C:\Users\Admin\AppData\Local\Temp\C970.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-12_d8ba7ea314b5cff29e06ee7232c2937b_elex_mafia_stealc_tofsee.exe 75CE3BA17BDADB70D2517B689A20F7C3615C2354116484E0BC821631B5E7FEADB7BA46CF998CE85E6E0481B8FB493DAEBCF35741BA41D149B8AD7FE57692AD08
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4992

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C970.tmp

Path C:\Users\Admin\AppData\Local\Temp\C970.tmp
Size 428KB
SHA256 d80ceba34cc53acdedb7bf74a75028c3d49c53c639f8eb710ebafd2dbea7374d
MD5 c48d15c56a549efe7cd01fc3b61863cb
SHA1 3731d3acce1432e77a302d7ce73ac436493d5276
SHA512 5da25c660c9837ac5fcdfa1ac1441b571599348db238f7957fc4297207b2e4faadd4291168d7fd0268b912cd063632ebb7cce2c1b06de24535f78b254d471386
SSDEEP 12288:Z594+AcL4tBekiuKzEryQeLidEJh4mLyAXNVEcRRW5O1FPIMl:BL4tBekiuVrMhh4mLDdmcRA5O7gM
TLSH
T1FC94F0313682C033D69319344BF5CB66597E79B54B26A9CB7B9017BD2FA02D2D63830B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download