d34da0dab2e3d763e540a25ac5e57a9d12a2ee50e408f50ad418b97b3215e983

Analysis

max time kernel
148s
max time network
129s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
14/08/2026, 23:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260814-3j2ecacf49
SHA256 d34da0dab2e3d763e540a25ac5e57a9d12a2ee50e408f50ad418b97b3215e983
MD5 7b97e818fc73acd87d96c375cc06607a
SHA1 727d0fca36ae0759c21528a6cdac69d033f8198e
SHA512 e6b5662041a6efb72d13a51f436ff459bbe579eeb126398bb479708919ff5e9214da4617374324100e7583fe94146cc32bef98f60ed2d7247625788d348f1987
SSDEEP 12288:Nb4bZudi79Lea2Is0ZlHdl4aRnglZgX5zzyiA0a:Nb4bcdkLcIrZVduinKZo0
TLSH
T1DEA4F1213182C037E2A702354AE6C7F6657E7DA15F61A8DB3B903B6D5EB02E1DA30317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6016	F19E.tmp

Executes dropped EXE 1 IoCs

pid	Process
6016	F19E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F19E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2608 wrote to memory of 6016	2608	2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2608
- C:\Users\Admin\AppData\Local\Temp\F19E.tmp
  "C:\Users\Admin\AppData\Local\Temp\F19E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-14_7b97e818fc73acd87d96c375cc06607a_elex_mafia_stealc_tofsee.exe B97E5AD53DD81335B0B73AE49CAC9D4F39608795D21B9EBFD30DC35E5DF461BA97564E9AB419B4457430CF050C1BC098D06DC1CF0C503D809EAC2AEDDF2BA5DD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F19E.tmp

Path C:\Users\Admin\AppData\Local\Temp\F19E.tmp
Size 473KB
SHA256 ca4f31a46b2012f3489cc8f72a07218343c60d978440b78144dda8f108146bf5
MD5 1eb8a3d9144cb8e00716af8035746805
SHA1 56499ef09da8b2a735b1bba12fd484525e89d703
SHA512 8e316270216a59dfe6ab4fb3f6c8085b18804a006ccdb688fea161b77ead567cba879d0fd13d2971d003cb195a568606bfe59c4030458dc8ecc99feaf9e01d9a
SSDEEP 12288:Nb4bZudi79LV+HQX7uv16TeUxAienvPvV/mChDI1A0a:Nb4bcdkLV/r0ZUxHodTIk
TLSH
T1B4A4E0103181C037D2A716344AE6CBB5553A7EB19F6268D73BD03BAE6EB02E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download