7f6b6a6238a0b613eca125a18b9a26cda5ff3d4c131d62d085a0e66ba0a9303e

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 21:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_c8a98326bbcc29d977bfb16b398b3452_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260817-z84dfsdg62
SHA256 7f6b6a6238a0b613eca125a18b9a26cda5ff3d4c131d62d085a0e66ba0a9303e
MD5 c8a98326bbcc29d977bfb16b398b3452
SHA1 ed605d758e9d4ede4fd51016af1713f100c76db9
SHA512 79eeffae070bacadc6c151ba94f9224b6f95d36d1efdfdc235324bee78e62bc18d9b0c3d13ffc9058aec88b3f62e848947b6188d1c4f4d4f3cbeabbdf5c88a59
SSDEEP 12288:aO4rfItL8HR0VeMwKN4O2Vc4yZbSWfHEn7K9wlsDpVFd:aO4rQtGRlMwKNP20bSRn+9wlsDpVFd
TLSH
T1C7A4F12A7681C133D69302755BE6EBDA663E35B10365A8C737D4033E2F656E1C33A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4184	6344.tmp

Executes dropped EXE 1 IoCs

pid	Process
4184	6344.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_c8a98326bbcc29d977bfb16b398b3452_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6344.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5672 wrote to memory of 4184	5672	2026-08-17_c8a98326bbcc29d977bfb16b398b3452_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_c8a98326bbcc29d977bfb16b398b3452_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_c8a98326bbcc29d977bfb16b398b3452_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5672
- C:\Users\Admin\AppData\Local\Temp\6344.tmp
  "C:\Users\Admin\AppData\Local\Temp\6344.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-17_c8a98326bbcc29d977bfb16b398b3452_elex_mafia_stealc_tofsee.exe B8369DC7465563F7C02B504CFE44340752B81F7557C6C624154ED49A97876A5C4963DFF25E3CA186B30DFD92A50818CC8C4B4ECE7053FF1DE4A2DC243F8206A6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6344.tmp

Path C:\Users\Admin\AppData\Local\Temp\6344.tmp
Size 476KB
SHA256 5e078bdf267c9617beaf95388e91043ff9877c9c1f210375acc783fce3e4ec21
MD5 109dc2bd9fdd9f764bea5e9f09d671ce
SHA1 98d8e55f1fd953ba24c2feebea2ab575076796e2
SHA512 f4aa3a7586ae3cc2993fbec2f6ebc7ba3a25a901c7e0778731034ab4ecd5237d523a57218bcd2f7c0bab93fd9a2298ea4d9cf086ceef8bd43ade06b72c172fe5
SSDEEP 12288:aO4rfItL8HRrkCjAlP6LFy7UheapjG4INX/k7K9wlsDpVFd:aO4rQtGRBjsoy4heaxGvk+9wlsDpVFd
TLSH
T114A4F1267681C133E29201351BE6DBEA7B7EB8B40769A4C33BD0026D1F656E1D37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download