fb87fbac6ef4ad863297230e3d654e12dded1bcb8f7a91c8feebe5bf671fb985

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_57012ed6d54a166288529d28fb9ed4df_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260816-e6qdlazcrc
SHA256 fb87fbac6ef4ad863297230e3d654e12dded1bcb8f7a91c8feebe5bf671fb985
MD5 57012ed6d54a166288529d28fb9ed4df
SHA1 0ca97dfc3f61f2a51d4df0eadcade3ed1e0f743b
SHA512 9667f83e1d83199699195a75acf2fdd7ac5e2a6c8215202f7f888e67fa4a0a672011c2da092acb7e117535db4795c3988272a4ba7312390d3872c3198c2ba765
SSDEEP 12288:Nb4bZudi79Lyyyeeq7ujtXUOj6l4WF7A:Nb4bcdkLtL2jC4WF
TLSH
T19DA4F0203681C037E29322340AEACB75A57E7D715B2668C737E46BAE1E742D2E735347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2168	9570.tmp

Executes dropped EXE 1 IoCs

pid	Process
2168	9570.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_57012ed6d54a166288529d28fb9ed4df_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9570.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6128 wrote to memory of 2168	6128	2026-08-16_57012ed6d54a166288529d28fb9ed4df_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_57012ed6d54a166288529d28fb9ed4df_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_57012ed6d54a166288529d28fb9ed4df_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6128
- C:\Users\Admin\AppData\Local\Temp\9570.tmp
  "C:\Users\Admin\AppData\Local\Temp\9570.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-16_57012ed6d54a166288529d28fb9ed4df_elex_mafia_stealc_tofsee.exe 3B183F717079B9EA71308A7AC80DEF3F34AEFA62793EF3229FD908316704D26177825D322FD0960E732EC2F3AB93F9B43B6A6D1A0601C85F3C95EA2CFFE41644
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2168

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

9570.tmp

Path C:\Users\Admin\AppData\Local\Temp\9570.tmp
Size 444KB
SHA256 b6abba810a371e10075bc776d7f76e6707e49d1b9904d713baf339f4edb63d53
MD5 93e764f54a8db6248f88a1d307fd23fc
SHA1 fe0e8f37754dece0215f1f857819312e62839221
SHA512 2ae2bd43fc2d16d502d88acc1b6856a249c4306fb5be2e62a8d319782b8a620c0542928c93e8022491f27d108c091058ddd9d4bdccc28146ede056b65b5bbc8c
SSDEEP 12288:Nb4bZudi79LevOWVhEVYwMjfBoerE7Z5ssY5X1mTu8e5CA:Nb4bcdkLeGkEVYJCDN5dY5XmX2
TLSH
T170A4E0243181C037E26B05394BE9CBB6657A78B14B266CC737D06BBD1EB42E2E635317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download