d22c0490066fa6f7e45a1514b153ce14eabe7ec0b1e2a5118b99c6537bf14578

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/08/2026, 23:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-29_f8f640232561fc2d43ae3fd2e7ec0901_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260830-259geadg73
SHA256 d22c0490066fa6f7e45a1514b153ce14eabe7ec0b1e2a5118b99c6537bf14578
MD5 f8f640232561fc2d43ae3fd2e7ec0901
SHA1 96cd45c9387fa8f244f1f449dec5d1edd2d4f315
SHA512 00830726e61667b0b94f2d45233409b0e674f7c24abcb2f417541a0ccfe2575ea263990706e355c4bf60b36ae13527d9d4c4658c39a0849acd727d3e23984887
SSDEEP 12288:aO4rfItL8HRtjsfuDmZf+ghmWdnTEYnw7K9wlsDpVFd:aO4rQtGR5sWgzBTEYw+9wlsDpVFd
TLSH
T1B1A4F12676858133D6D212700BEAC7EAB63E7971172694C37BE4027D1F226E1E37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4092	C7A0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4092	C7A0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-29_f8f640232561fc2d43ae3fd2e7ec0901_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C7A0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5048 wrote to memory of 4092	5048	2026-08-29_f8f640232561fc2d43ae3fd2e7ec0901_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-29_f8f640232561fc2d43ae3fd2e7ec0901_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-29_f8f640232561fc2d43ae3fd2e7ec0901_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5048
- C:\Users\Admin\AppData\Local\Temp\C7A0.tmp
  "C:\Users\Admin\AppData\Local\Temp\C7A0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-29_f8f640232561fc2d43ae3fd2e7ec0901_elex_mafia_stealc_tofsee.exe E35E354E29FC52EB67E9B681C11120BFCE95D8B862BAFB99DA7AE805D8E47D191C0D4201BAFDF6CB067534D622CF43AA9EB9C28ABADB4E1AF579A45CDADD65B0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C7A0.tmp

Path C:\Users\Admin\AppData\Local\Temp\C7A0.tmp
Size 476KB
SHA256 3e87971174aad10892e0dcef70a3b7ee4827041518e0cadcfaabf8660abdc710
MD5 f7bd38ee4efcd4b7ba8fcb9676c62a51
SHA1 d8aca62937cad6a1aa913e5782e7dead704de50c
SHA512 929b0591610a616a09635ef26341323d65ac9b7660aec7446a113a38e05ebfbdcdf352faad747786cbf4cb558030741846473bf89fcc497bcbd675266c000754
SSDEEP 12288:aO4rfItL8HR4Lf4h/t54qrb13cMd+bVoV8auY7K9wlsDpVFd:aO4rQtGR5R4Cb13cMd0lY+9wlsDpVFd
TLSH
T1A0A4E025B681C133E2D302751BEADBA6A63E78705725A4C33BD4026D2F61AE1D73A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download