973ad1ffa8b2f166cb10458b4082d8e2b0020be54a94f4fe7f05eea4862177dd

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_daf7fde0c940a5fc7d0f725b286509ed_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260817-pqanbabe63
SHA256 973ad1ffa8b2f166cb10458b4082d8e2b0020be54a94f4fe7f05eea4862177dd
MD5 daf7fde0c940a5fc7d0f725b286509ed
SHA1 f875bf6b06864067d997883e45d8195df526ea0b
SHA512 46b092c00e07c227d71a09aa916512fa0049ff2357455d762ac8f2d16e9152a138c1de7ebbc7cb66423806cef526c58cfd8e4c35291fb40bf384d63fbe221b2a
SSDEEP 12288:qO4rfItL8HG/aqDTFaf3OxI7zxJzYTj7bWmeEVGL:qO4rQtGG/a05ap7z4jumeEVGL
TLSH
T1E6A4E02A7201C133D29302B55BE6DBAAB63E74B5432694C737D4027E2F65AE1D33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5800	747A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5800	747A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_daf7fde0c940a5fc7d0f725b286509ed_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	747A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5368 wrote to memory of 5800	5368	2026-08-17_daf7fde0c940a5fc7d0f725b286509ed_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_daf7fde0c940a5fc7d0f725b286509ed_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_daf7fde0c940a5fc7d0f725b286509ed_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5368
- C:\Users\Admin\AppData\Local\Temp\747A.tmp
  "C:\Users\Admin\AppData\Local\Temp\747A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-17_daf7fde0c940a5fc7d0f725b286509ed_elex_mafia_stealc_tofsee.exe 41D936FE821D517C45436701D551281C4D2F006188C9069D67270638FBAE2C2122CE5DA123B9864CAB8B0E9E16A9B3F4C212AB7B1ED56D428C5D3E26C41D3BD3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

747A.tmp

Path C:\Users\Admin\AppData\Local\Temp\747A.tmp
Size 468KB
SHA256 7e2adca331c0727a98777cc7cbc22f160e529bc5f0c96e4468c331df3892393e
MD5 5ac1ac9f2577e6ac852d46346f8ddd46
SHA1 014fd14c437231c0bda71367fa4ef7b4a8b03857
SHA512 a15c10ac9af0e2938389bda026bbede4774533c2576954ec0fa97eb5f52fe72ee215af26f9f8b1e82faee7b84b742c04d8a5962dcbb6204532550e3389df4d24
SSDEEP 12288:qO4rfItL8HGdyg49Mow69cH8UYJcZFUm7bWmeEVGL:qO4rQtGGj49MojOB/umeEVGL
TLSH
T1F2A4F13A7241C133C29311711BE6C7AAAA3E79B54725A4C33BC4077D2E656E1D73A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download