1eeec76f37f1700b6e03ec0421bc117b2fea87bd0a79f6b210b03efe6ee3ef27

Analysis

max time kernel
150s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 22:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_e07ba5ded27cae911dca5d347579c0ff_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260814-2tx91atyct
SHA256 1eeec76f37f1700b6e03ec0421bc117b2fea87bd0a79f6b210b03efe6ee3ef27
MD5 e07ba5ded27cae911dca5d347579c0ff
SHA1 ce654ffd1c53f26d67201ff9be57ed80ce8caeac
SHA512 0a94a8fc5c512110ca6a01d580511e579ff12eb260f30707cfad2bd237b14ae5695f3094c56284995e91fc3609770cace2e674874478764d8cdf1ec70f177677
SSDEEP 12288:Ci4g+yU+0pAiv+GrlrBSSBPpIITFPJzinG0n:Ci4gXn0pD+Gr7SUpHxJOGU
TLSH
T1A694F1203152C037E2A215394BE5CB666A7E39750B26B8CB3BC44BBD6F643E2D635347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5212	22A1.tmp

Executes dropped EXE 1 IoCs

pid	Process
5212	22A1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_e07ba5ded27cae911dca5d347579c0ff_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	22A1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6108 wrote to memory of 5212	6108	2026-08-14_e07ba5ded27cae911dca5d347579c0ff_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-14_e07ba5ded27cae911dca5d347579c0ff_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_e07ba5ded27cae911dca5d347579c0ff_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6108
- C:\Users\Admin\AppData\Local\Temp\22A1.tmp
  "C:\Users\Admin\AppData\Local\Temp\22A1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-14_e07ba5ded27cae911dca5d347579c0ff_elex_mafia_stealc_tofsee.exe E519B3111844A3BE1CC586913DA6C2CD7118153BA116500EB5A174DF04014CB79F0FA6B5A3DFF28713E988E5682FE0D79A857560E24857471FFA6CD7A8F0C0F4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5212

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

22A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\22A1.tmp
Size 433KB
SHA256 509b3818ec93a66b428507c92cf22863850e26d10e8ce387ca36cd0ff1edad99
MD5 0518709474581390cc8befb9a1104191
SHA1 6eb750cef1c0e43a2a1ed5544c4912fe5bb2eb35
SHA512 f14d9e2085ce4997a4d99856799056c060296804db2a690518270a60c8745251506510e830949e43f4c278805d448138a52f321c8c354ae87de281ee42096919
SSDEEP 12288:Ci4g+yU+0pAiv+J5Xq5poHRZUAZwtL27Lghc2n:Ci4gXn0pD+JNqb0CId7LghcW
TLSH
T17E94F1303542C033E1A306354BF5CBA969BE39B64B25A8CB77D41BAD6EA43D1D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download