449314d7b51ccff81fd134c4e85488ce504908fa07215939ce2b1efec31e6057

Analysis

max time kernel
148s
max time network
131s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
08/09/2026, 18:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-08_24e5daa3b183188282e75855d18ecb74_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260908-xee3naxblf
SHA256 449314d7b51ccff81fd134c4e85488ce504908fa07215939ce2b1efec31e6057
MD5 24e5daa3b183188282e75855d18ecb74
SHA1 6d357066040af3740edecb83586eaab142ab8f86
SHA512 ce762edc7935c0d7a055d99aac7d65b60d6bcabf9228ee3194d7e8dc870f9210370c74619c573e464e16d7f8bce90b6b7f2ad5abd03d2983e12dedf7f2394bdc
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStrSfh84jdXzhOt+ds898SgoQr3oU/WClNRTS:Nb4bZudi79LAyRoiQr3xOOTpvyMYqA0a
TLSH
T125A4E0203181C037E1A602354AE6DBB5A67E7DA14F7664C73BD03BAD5EB02E1EA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2356	2224.tmp

Executes dropped EXE 1 IoCs

pid	Process
2356	2224.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-08_24e5daa3b183188282e75855d18ecb74_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2224.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 2356	1580	2026-09-08_24e5daa3b183188282e75855d18ecb74_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-08_24e5daa3b183188282e75855d18ecb74_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-08_24e5daa3b183188282e75855d18ecb74_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Users\Admin\AppData\Local\Temp\2224.tmp
  "C:\Users\Admin\AppData\Local\Temp\2224.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-09-08_24e5daa3b183188282e75855d18ecb74_elex_mafia_stealc_tofsee.exe 68C87AEC66EE1DCF5DC8366DBAEEBB23E94A76D5D9523278E12C3A97FB64BDDE7CD116C73C61A9240C079FAE6B39A55009898C8427F05E752A1AED04EC07DAAF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2224.tmp

Path C:\Users\Admin\AppData\Local\Temp\2224.tmp
Size 473KB
SHA256 1f79de6311d2dae5a54e3a43d4385a082a7f712a6c37244211ca552c290b4541
MD5 fae51b4d0a9042f447a8badd3a6464b3
SHA1 21bc4623348b49a5f20505bab3cee89d5e528daa
SHA512 b2a6f3b1cc81fd998b394322f3421d6c3da93356b9cfa7aaaf52f8a6ddb7837ae50ff0adf6a3d56bcca1b926119ed92a90207bc232762f05e2508257a93841e2
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStxeqa8FYa6Nq+McY3IRf/6Ft+iZdC/aIpzSy:Nb4bZudi79LTz8FYaqq+Q3wIt+FCLA0a
TLSH
T160A4E0203692C037D19306394BE6D7B5567E7DA11F2268CB3BA43B6E5EB02E1DA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download