614515a0b19f590f648e53483e362cebdceea6b65dfec4cbb8087c73efc330ef

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/09/2026, 23:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_b963379d5660657371c20fb1abcd1e27_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260904-3bv8csaf72
SHA256 614515a0b19f590f648e53483e362cebdceea6b65dfec4cbb8087c73efc330ef
MD5 b963379d5660657371c20fb1abcd1e27
SHA1 7c525754d8a04f66335baf530923fbb68310e247
SHA512 9d6832bc06ff7e41e6540e4026d480fca89fe22284f4db12c4c6a38421c7d939ba10bf53ea2d194019d694e3176b9e33c2f58816b615c1cf48fd2d14c11d7718
SSDEEP 12288:Wq4w/ekieZgU6wtxvKSks13mMS+T82avWEaCGl:Wq4w/ekieH6OSqrT82y8
TLSH
T12694E1253586C036E1A706384BE5DBBA593A7D644B35B8C73BD42BAE5E702C1DB30347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4176	572E.tmp

Executes dropped EXE 1 IoCs

pid	Process
4176	572E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_b963379d5660657371c20fb1abcd1e27_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	572E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2300 wrote to memory of 4176	2300	2026-09-04_b963379d5660657371c20fb1abcd1e27_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-04_b963379d5660657371c20fb1abcd1e27_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_b963379d5660657371c20fb1abcd1e27_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2300
- C:\Users\Admin\AppData\Local\Temp\572E.tmp
  "C:\Users\Admin\AppData\Local\Temp\572E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-09-04_b963379d5660657371c20fb1abcd1e27_elex_mafia_stealc_tofsee.exe 9DACF1563FFE52F4CD3F9A218E706E9A28A0A0306D7F6CC3FC377455C7BF508A8070EE3B6B8A9BE90F102E86A539B805CD28F7016479D81C08C293D2F486C451
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4176

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

572E.tmp

Path C:\Users\Admin\AppData\Local\Temp\572E.tmp
Size 414KB
SHA256 6416343e9d0b9299cc1ae26639188ed99e3f26f50ce2df74cbcebb5dc20af5e2
MD5 3d5a65334532213227c132f65fbb0a41
SHA1 0a0582f4aacb955d75b243fc2af393678dd1db79
SHA512 a2d0082ebb657d546ea2cddc6db5b98be95a57cf2eadbc9e6a84c3c71bff59a1fe8aa65f0fd5372ce7029a58b76bd526ea740c67d9d213f4f878235d5c3c0b95
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYfecSD90sFLH4deIz1nyIqDh2nkLIpwml:Wq4w/ekieZgU67cSOsFLYdFjqDmEml
TLSH
T1BB94DF353586C037E2A716344BE5DB6A593A7DB10B36A4C73BC02BAE5E742C1DB3424B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download