24b8d1cdf0448c5dcdff62f13c8d2525d34a4e3ed5c68edc33c9b450995d52ec

Analysis

max time kernel
150s
max time network
144s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260814-2383vstdka
SHA256 24b8d1cdf0448c5dcdff62f13c8d2525d34a4e3ed5c68edc33c9b450995d52ec
MD5 bad17f3aed2c33c03f78fcbbd02f67ea
SHA1 b6feec8427aebaee17a44a49def05155e6d7c146
SHA512 fb61f2062d061b16c5451ed3f19beff4f6023a63191db6763368222de0c9e59a5ca9e9ae97eecdd7241ad36e265e9043b0dd8a7b3b6dd1f343c7108ad3bd3529
SSDEEP 12288:fd4x+ePixnXQjaVLLSSvKSjOjOxY8McwP:fd4x+ePixAj4uSSSjw+DMc
TLSH
T1A494E0203586C03BE1A716348BF5CBA9593A7DB44B32A4C777C42BAE5E642D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1692	2EA7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1692	2EA7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2EA7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5228 wrote to memory of 1692	5228	2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5228
- C:\Users\Admin\AppData\Local\Temp\2EA7.tmp
  "C:\Users\Admin\AppData\Local\Temp\2EA7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-14_bad17f3aed2c33c03f78fcbbd02f67ea_elex_mafia_stealc_tofsee.exe 445EFDA35D0A0080476D068079A5B18A9A68EEDCBC35760A1AC96E1B63BB86E934CB4512C443908DBB2D60B7760781C1F3F0B1895D81BF4A31ACCFEEDDA0BD37
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2EA7.tmp

Path C:\Users\Admin\AppData\Local\Temp\2EA7.tmp
Size 435KB
SHA256 4dd5b49af1c7c3f798c5b5c9487791bc5d359f627e552406cd837713f9af8a24
MD5 b21e04e27fb80973c8bda91788f4ff8b
SHA1 230bf3c6801e0d76e26899dfb5f3b95efbcc4563
SHA512 80f576d14316beb41ee59899c1f2316137f2869d21242da7d490bb4fa23d88df102bb12eae269be73c3a21a0da743eebf6d9c50b440202533dc7b6f6c227ec68
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYi3ybjSZ/Qb6x+eH9ONR8/OU2bmSFU/78JTaDHt:fd4x+ePixnXQjrQbce9b1FUgwQwP
TLSH
T1AF94E0213586C03BE2E315348BE5DBAA586A7DB04735A4C77BD42BAE5E702D0DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download