469e7af212523719d615a1eeb0b18ac3ddaaee12afbfbba2d1b86e94c00e966e

Analysis

max time kernel
150s
max time network
128s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 03:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_ffcfb4fb1d86695b535cd8ccce292c8c_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260819-d78e5axyay
SHA256 469e7af212523719d615a1eeb0b18ac3ddaaee12afbfbba2d1b86e94c00e966e
MD5 ffcfb4fb1d86695b535cd8ccce292c8c
SHA1 ad9541bc8fcf3cce8515427d4d0cc50ac5f6b66d
SHA512 3353fec7565b77df5e421806e3e688a7631a9b7d60c5c386c99a6d3dd07d0624fe01f5fd8dddd5ffc48b662f7fafcd392fe4f9707510255960b173dcd0a34552
SSDEEP 12288:Nb4bZudi79LFwZAefMG0JhiHNU2S8rCpoovd2A0a:Nb4bcdkLSZAeUdhiHneoa
TLSH
T184A4E0243181C033D2A716354AE6C7B6567E3CA14F6264CB3BE477AE6EB02E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4688	8C87.tmp

Executes dropped EXE 1 IoCs

pid	Process
4688	8C87.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_ffcfb4fb1d86695b535cd8ccce292c8c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8C87.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5496 wrote to memory of 4688	5496	2026-08-19_ffcfb4fb1d86695b535cd8ccce292c8c_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-08-19_ffcfb4fb1d86695b535cd8ccce292c8c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_ffcfb4fb1d86695b535cd8ccce292c8c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5496
- C:\Users\Admin\AppData\Local\Temp\8C87.tmp
  "C:\Users\Admin\AppData\Local\Temp\8C87.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-19_ffcfb4fb1d86695b535cd8ccce292c8c_elex_mafia_stealc_tofsee.exe 884428B497623686540B17FB148C508152CD6C05586886F3156F2F0CC567775D6A948987D49A09B356AE2D0B7A42F52BF1357B7C7E6C7A4F0FFD4FAB7F086FFC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4688

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8C87.tmp

Path C:\Users\Admin\AppData\Local\Temp\8C87.tmp
Size 473KB
SHA256 363d03f73f22b685aabf26968f8c86f174b3af53383c49764dd90a4ce3dfa2c2
MD5 1bdc5690f66ca2967eb5d3c907895dc3
SHA1 b777f7ce32b1617ff376dd00ca69f2a9f1545619
SHA512 ffb3b351f2167aea28869ab83806c0d873a9e8f291502ac285ef63bea0355cf44353d6cbb03cf682c5a40ebb3cdc8abeb7c7cc7a5459e7975727b0b76ca6b2e2
SSDEEP 12288:Nb4bZudi79Lbn40nlx7rG/1m21fyxy7PX02W8DVuA0a:Nb4bcdkLF7Cm21axyDdxN
TLSH
T10FA4E1217181C033E2A706354AE6C7B5553E7DA15F6668CB3BD03BAD6EB02E1DA3530B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download