2d662dfd1c3e52e04142daa14efb1a1d037479fb8c451a86ac56041d03faf33e

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 15:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_b25f9ec8868741c03937a2f154caec29_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260817-smpjvatalb
SHA256 2d662dfd1c3e52e04142daa14efb1a1d037479fb8c451a86ac56041d03faf33e
MD5 b25f9ec8868741c03937a2f154caec29
SHA1 45ee5e9f3daf3e2d9bc438e5c51ad91dc12b0bc3
SHA512 3112600354cf903c44b496a049568a6213bff4b8c5373636d26614d53041c18c90f065ebf79ff95c8473ed560636690bfb2226d79f2c1b64fa28e91539fa433d
SSDEEP 12288:fd4x+ePixnXQjjREFGdwrJ/hkGWBRanKwP:fd4x+ePixAjmFGdwrJ8anK
TLSH
T1EC94E0243586C037E1A616348BE5CBAA5939BDB04B36A4C737D02BBA6F742D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5472	F17F.tmp

Executes dropped EXE 1 IoCs

pid	Process
5472	F17F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_b25f9ec8868741c03937a2f154caec29_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F17F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3528 wrote to memory of 5472	3528	2026-08-17_b25f9ec8868741c03937a2f154caec29_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_b25f9ec8868741c03937a2f154caec29_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_b25f9ec8868741c03937a2f154caec29_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3528
- C:\Users\Admin\AppData\Local\Temp\F17F.tmp
  "C:\Users\Admin\AppData\Local\Temp\F17F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-17_b25f9ec8868741c03937a2f154caec29_elex_mafia_stealc_tofsee.exe A71C2C5FE034488AD64DB1937F5FE95E4EF357415B90D893191FD3E7CF5E596E99F88DBA0E219CFFDFE9A01BC53D87F32F1F5A6E80FBF91B4E97C70978ECE280
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5472

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F17F.tmp

Path C:\Users\Admin\AppData\Local\Temp\F17F.tmp
Size 435KB
SHA256 0329cd879565bc9b2bf3456fd50a6e9322bbeb3dd8ccea1fa0834fe03a3cdbb9
MD5 740f6a955def610ac49b7325c7f9cd10
SHA1 d96bd68296ea8fca8f8b9259485aeea305140a99
SHA512 44f85bfa2cdd7f7441c6a483447e096ce4372e3734417486cecd86ffa7e90bd6c74033b90c5b4e52997048ae69a42072dd900bb1d3c1a918e97f55d3f8dc52a5
SSDEEP 12288:fd4x+ePixnXQjRjs6UM/zm7U8ugESbT7wP:fd4x+ePixAjR47Mbm7U8u/o7
TLSH
T11D94E0217286C037E1E705388BE5CBAA593A7DB04736A4C77BD427AE6E642C1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download