8dad60a8336d51d249ffef2d560adfd02a50376e8433779c0b77f8ec6314e648

Analysis

max time kernel
148s
max time network
147s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/08/2026, 00:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-14_3c481177854e73ebacf6824da1c683ac_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260815-abeamavang
SHA256 8dad60a8336d51d249ffef2d560adfd02a50376e8433779c0b77f8ec6314e648
MD5 3c481177854e73ebacf6824da1c683ac
SHA1 83a5ed5877d8ef3c6283049d84f24ddb1a838b3c
SHA512 a4772ac60e03e534b771050da62a16f364a8cdb99007f25e8fe51c76d72cee98bd0f276fc03c9261cedc8311bff90064ab3236e50ddc70b6839b205b9adeab3c
SSDEEP 12288:Wq4w/ekieZgU6wfnOLPqgpgQf0lVYIGlMa:Wq4w/ekieH6wvE/giYGIGP
TLSH
T19BA4E0217182C036E2A706388AE5CBB9553A7D654F71A8C73BD037AE6E706C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3548	2532.tmp

Executes dropped EXE 1 IoCs

pid	Process
3548	2532.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-14_3c481177854e73ebacf6824da1c683ac_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2532.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3488 wrote to memory of 3548	3488	2026-08-14_3c481177854e73ebacf6824da1c683ac_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-14_3c481177854e73ebacf6824da1c683ac_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-14_3c481177854e73ebacf6824da1c683ac_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3488
- C:\Users\Admin\AppData\Local\Temp\2532.tmp
  "C:\Users\Admin\AppData\Local\Temp\2532.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-14_3c481177854e73ebacf6824da1c683ac_elex_mafia_stealc_tofsee.exe 46FD16AB41C2B865545ED4FBA0908A9F1AF5333A392FA545D1B49F6A5998BABB1CA5CDF61941E48C6EF5C0784D542BB6D3F43775F916D6B420223ED8566ED2FB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3548

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2532.tmp

Path C:\Users\Admin\AppData\Local\Temp\2532.tmp
Size 443KB
SHA256 8ff0cd1498d9dca3eafef4b63f9a86029e2e9e82803dbe163d7d6ed1aea825ff
MD5 11baba86f287d5ff3b08477337a4fafc
SHA1 a758016fee0a2043df8c4e8b0b921748dbd47d75
SHA512 dc4ad2ece28a8492b52c1b11ee9f22c16a27c24ce6633eb07fd22f7e549dd8ed7477669c519de14aeb9cd3facee868d1795f145981288eca6a4edf003655d1ac
SSDEEP 12288:Wq4w/ekieZgU6nWpVKPL1CGcymMSvwW+ZSSlMa:Wq4w/ekieH6nWSCGKN+wSP
TLSH
T155A4E0213182C037E2A706358AA1DBB5593A7D645F71A8C73BD037AE6EB06D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download