078a523f80c2e8301fe7d14fa96c1f7b03c2e265dcd56aacd07aad3fdd5bdde3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
05/09/2026, 11:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-04_4a502d9364366dd638631655e5216fb6_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260905-ny8pmsdf22
SHA256 078a523f80c2e8301fe7d14fa96c1f7b03c2e265dcd56aacd07aad3fdd5bdde3
MD5 4a502d9364366dd638631655e5216fb6
SHA1 4b40cd93edeb3bb8805d6df60acb0e6575f02f3e
SHA512 6aa7b4badf6e522edb90286ba9904e4e8946de3dc8ce8ee64f7e55bf8ef5a48c8b8f77fd1144dbfa36e806dc9517d08cc0ba858894d317a778df16901c9cccc9
SSDEEP 12288:Wq4w/ekieZgU6jx5ubNR/HNqwIxdJQ//lx:Wq4w/ekieH6VHw8HW/r
TLSH
T18C94E1213546C037E5A715398AE1CB796A3A3D714B32A8C337D42BAE6E746D1CB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3588	5152.tmp

Executes dropped EXE 1 IoCs

pid	Process
3588	5152.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-04_4a502d9364366dd638631655e5216fb6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5152.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 3588	5220	2026-09-04_4a502d9364366dd638631655e5216fb6_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a502d9364366dd638631655e5216fb6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-04_4a502d9364366dd638631655e5216fb6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Users\Admin\AppData\Local\Temp\5152.tmp
  "C:\Users\Admin\AppData\Local\Temp\5152.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-09-04_4a502d9364366dd638631655e5216fb6_elex_mafia_stealc_tofsee.exe 81D203D680F7CDE0299688648B927D5085633A358A80676F1BDB6773504C03B5F3EDFE59A3FFCFC6722C996A0BF913DDA3CD5AFD7CD6B6E3BA3D9E38C1C34DD8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5152.tmp

Path C:\Users\Admin\AppData\Local\Temp\5152.tmp
Size 414KB
SHA256 50568f4bf5e5c778fa9eea1dfeaeb8f1878e738f12f22cc1cf0482a506bc771a
MD5 34d3d516658dfc68a81559fd031c1e69
SHA1 8631216333faed2e958724ffdaa4c06fb5eff966
SHA512 49d38c7029d6a7eaa4cb70128e168200adb2df3dfc01a3a4b91bf49a16b7f5f4db79294f7456a40d9d0ae7f089404e7215f665a24c8ba8ec13b08329384ee1fb
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BY5vDHsIHEo3onWvLsfqhKAAIX8zeHbNclx:Wq4w/ekieZgU6yDjECLscKAAu8SNclx
TLSH
T13294D0213686C037E5A712384AE5CBA5593EBEA50B31E4C737D42BAE6E741D1DB3034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download