86eaabbab76ff273a436b68654a5fc2d6674e95cb5b5eca2deff0aef84674291

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 12:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260817-ptqhya1wat
SHA256 86eaabbab76ff273a436b68654a5fc2d6674e95cb5b5eca2deff0aef84674291
MD5 c81b44f96a514328cc602097a996ace9
SHA1 eb37770c58f6631c1aa041e649ae3a96ae8dcc58
SHA512 b633bafbfb5626e249c2f3f4d8608c1108abbf1dd4c5b582e3f9133170d7fbc64d5af8c03d1e85f861005d213f35d5c3f85610267295c58799fb791de46b59f9
SSDEEP 12288:Z594+AcL4tBekiuKzErJSFQUV2WSR5lO8AcXwl/eLmLjLBqrl:BL4tBekiuVr087AJe8jq
TLSH
T1AD94E0353586C033E16715354BF6C76A597A7AB60B22A8CB7BC00B7E6EA06E1C735307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2616	3946.tmp

Executes dropped EXE 1 IoCs

pid	Process
2616	3946.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3946.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3336 wrote to memory of 2616	3336	2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3336
- C:\Users\Admin\AppData\Local\Temp\3946.tmp
  "C:\Users\Admin\AppData\Local\Temp\3946.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-17_c81b44f96a514328cc602097a996ace9_elex_mafia_stealc_tofsee.exe 6E3E5F0A9573FEE62F121E357C992AEF46C11FF407333D233145817B9F96AF4FC22C4C82F1C7EFB2C3CEF5B1EC54E54E90A4D5E180A1BE51719BD5A0C0ED09B9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2616

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3946.tmp

Path C:\Users\Admin\AppData\Local\Temp\3946.tmp
Size 428KB
SHA256 16e8a7716666c3cb2ed710fa52a9a51b7060e4fb7906b4913368070482412c48
MD5 29978f7b2839115f255d2712fce8c14d
SHA1 7f3581416b3d51e182ba4a6578cef6b1aef2ef90
SHA512 75148def71453704013472f7e888602fa95a6c43defaf4d1eda6ffb5a1c54dda614633d703e2c16f729ad63f12b54198878747ae923c15b7cf47f1a82004d88d
SSDEEP 12288:Z594+AcL4tBekiuKzEr7/nrAoqxHUrUn64kY27o8l:BL4tBekiuVrbnrAoqxHtki8
TLSH
T19194F1353486C037D29725384BE1CB6A593EB9B64B66A8CB7B8017BD1F603D1E638347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download