8207a905f7e9ee7942909f79a0fec48b6f8d163cc494a7293a3b45b389be9978

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 00:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_fe85f26001c7d0c543c0617ad50c54b5_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260817-amx7wazelc
SHA256 8207a905f7e9ee7942909f79a0fec48b6f8d163cc494a7293a3b45b389be9978
MD5 fe85f26001c7d0c543c0617ad50c54b5
SHA1 6b19eaaa0afe6442c00c27c4d9366b6b1ddbd30b
SHA512 06f648b610b10c11666fbea1c2345ecb9dfe9826e2b7c137ce24d295b49461c27aac2157fb8d00ae64003cd96945b925ba27b5391b2b3d5f9e01704a6aac4038
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStVjTwKcd1e+S5JyY/lj+ZJHtS3QpDjPBmTzZ:Nb4bZudi79LAvU2N4NS3QpZma6Qa0A
TLSH
T19BA4E0243582C037E29715344BE6DB66663E78E14B26A8CB3BD427BD6E703E1E634343
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1812	7C89.tmp

Executes dropped EXE 1 IoCs

pid	Process
1812	7C89.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7C89.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_fe85f26001c7d0c543c0617ad50c54b5_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3740 wrote to memory of 1812	3740	2026-08-16_fe85f26001c7d0c543c0617ad50c54b5_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-08-16_fe85f26001c7d0c543c0617ad50c54b5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_fe85f26001c7d0c543c0617ad50c54b5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3740
- C:\Users\Admin\AppData\Local\Temp\7C89.tmp
  "C:\Users\Admin\AppData\Local\Temp\7C89.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-16_fe85f26001c7d0c543c0617ad50c54b5_elex_mafia_stealc_tofsee.exe 8DEBF3FD67C6B4280C4EA047CD0918B93D4EEF29289C43A5200456D88714B281231663B1D7797C2550FBB8452E10337E0091C6BBEFEAF070EAA2C906A92CE114
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7C89.tmp

Path C:\Users\Admin\AppData\Local\Temp\7C89.tmp
Size 444KB
SHA256 a1005a858b9352bced55069b9bc6e5429c937cbef2dc1361f9b2c27df4522514
MD5 e1089c0d9878a6e8d2a1f5c87ecba954
SHA1 10a4a3b41dfe45f58f1119920113215cf624974e
SHA512 d64baeefa71b26bb6fd1bfdb0c4b76790f53e1a1c5783dc1a495f9fc10eb6fe894aa3c73b3dacf5014c0c0d6653d622b7e8425ab22f8cb16a4c2f5cd360bc363
SSDEEP 12288:Nb4bZudi79LIxIH0mz9HMzHSPERxwwe4aA:Nb4bcdkL7H0bzyPp4
TLSH
T1E5A4F1243082C037E2A716354BE5DB75663E7DA14B2668CB37E45BBD2EB02D2E631347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download