58056486cabf1b4fedf013e7a5d32ccfef42a4716bff2148326b0d01c2ddc4d4

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_bfad2cd1f72a5cc9e7529cfa1489844d_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260817-wt4twsfl91
SHA256 58056486cabf1b4fedf013e7a5d32ccfef42a4716bff2148326b0d01c2ddc4d4
MD5 bfad2cd1f72a5cc9e7529cfa1489844d
SHA1 5d72a7f7acfa89945e3d352850e5686af091efea
SHA512 72ac48a232d0f0851f7846d2d10764969be7e9ce0c5bae5f65b65b4b7dc1c65c5d387b503f837e6d05f4a9e4922c6451330f7a1f95bf09396d9c6459ec19a914
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYFgQICXsBAWnzL86xO5+Q6ssUqxdxMw9J:fd4x+ePixnXQjDCXsBAEaZhsUqXuwP
TLSH
T19894E0353586C03BE2A315344BE5CAA9687A7DA04B32A4C73BD02BAE6F741D1DB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1044	7CD7.tmp

Executes dropped EXE 1 IoCs

pid	Process
1044	7CD7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7CD7.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_bfad2cd1f72a5cc9e7529cfa1489844d_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1044	1080	2026-08-17_bfad2cd1f72a5cc9e7529cfa1489844d_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_bfad2cd1f72a5cc9e7529cfa1489844d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_bfad2cd1f72a5cc9e7529cfa1489844d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\7CD7.tmp
  "C:\Users\Admin\AppData\Local\Temp\7CD7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-17_bfad2cd1f72a5cc9e7529cfa1489844d_elex_mafia_stealc_tofsee.exe 8207E5A98A473D809537AD4904E899B29DF0A36BA707D2D6E1B44B5FAE7B0B7C0B957AD7382B9CDCB14BA8AC97F5715C02BF0058E3129190080D0C1DAE43930F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1044

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7CD7.tmp

Path C:\Users\Admin\AppData\Local\Temp\7CD7.tmp
Size 435KB
SHA256 0fab6e97989aac2d995ef12cfca553f686b205814109ceaf0add98d165c20ac3
MD5 f24e13257fea7abd49753040b6bc8237
SHA1 2303f57b5bcf0786c788714410762e7e76ab5e5b
SHA512 fed93e9d1f30c4723eec5a2835a0e657d851148af2d44b08b38022b86ee595bbcb30abcb15c2a371e7f65130dd8443c294a68932e05670bf304bd1059ed5fe53
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBY8tUqrRghusjX9F06P8I0HTIPeYXWuZve7ivJjQ:fd4x+ePixnXQjLb2XVaCvle7A5BbLwP
TLSH
T15994D0213682C037E1A605384BE5DB6A557E7DB04736A8C73BD42BAE6E742D0DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download