588617c7e646e1ed29109a21acb67a9910cb3815e227f15623948e6eb888b8a4

Analysis

max time kernel
148s
max time network
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
06/09/2026, 17:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-06_ceb593766b7eff0b4cadab4f3cced69d_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260906-v7m8maxsft
SHA256 588617c7e646e1ed29109a21acb67a9910cb3815e227f15623948e6eb888b8a4
MD5 ceb593766b7eff0b4cadab4f3cced69d
SHA1 368ed400dd7f94dfc70961e18f05743e83082e93
SHA512 03900422df9d0ab154a522687ebc5d7f508f6eb7a283232f8e254dca6a56a0e63125bf9c9f3118760cf03ccdf0d4559e6a2c215c2f47b68d6cbcff65967eb630
SSDEEP 12288:Wq4w/ekieZgU6moSG6kGYpLXqI7j06If9bl:Wq4w/ekieH6QkGYpL6IvIfh
TLSH
T13694E1317186C036E2A716348BE5DB7A593A7D610B36A8C73BD027AE6E742D1D73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2608	8FB3.tmp

Executes dropped EXE 1 IoCs

pid	Process
2608	8FB3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-06_ceb593766b7eff0b4cadab4f3cced69d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8FB3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2100 wrote to memory of 2608	2100	2026-09-06_ceb593766b7eff0b4cadab4f3cced69d_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-09-06_ceb593766b7eff0b4cadab4f3cced69d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-06_ceb593766b7eff0b4cadab4f3cced69d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2100
- C:\Users\Admin\AppData\Local\Temp\8FB3.tmp
  "C:\Users\Admin\AppData\Local\Temp\8FB3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-09-06_ceb593766b7eff0b4cadab4f3cced69d_elex_mafia_stealc_tofsee.exe 89CEE366019112379F6CF34E52DB3672E1BCF6AE362500CE7F7AE802E0961CFE2319A8D622C4555079CC8A2E60A6C91BA44DFF2FFD3E77C52AD745F2DEBDF58F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8FB3.tmp

Path C:\Users\Admin\AppData\Local\Temp\8FB3.tmp
Size 414KB
SHA256 d63c487c9507ddbd37175faee964615de063235771c5cc56baa8492e444ea678
MD5 fac4793dc8d90c8d86d74c7a723970d9
SHA1 dc63d8731917d320931c76561c37a7c0d34751d4
SHA512 1416dcaec72e34b14ed97b1cb7698787a5a29bc31f795f4dcdeedfc96cf9435284728129157e7635cbf4f74938a459682a50adcbe15f2cb7c88ac7782a237dfd
SSDEEP 12288:Wq4w/ekieZgU6XShuW66rCx6SM46f6il:Wq4w/ekieH6guGrwU4e
TLSH
T1C694E0253582C037E2A316308BE1CBA9597A7E614B31B8C73BD417AE6E746D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download