e0bf3d53a904ecbe7c45b0d95c3f3eeae763272c029df41d059f48664be2b678

Analysis

max time kernel
148s
max time network
143s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/09/2026, 12:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260910-p5fg4stene
SHA256 e0bf3d53a904ecbe7c45b0d95c3f3eeae763272c029df41d059f48664be2b678
MD5 9da0877e85c4a0e14954fb4c21cc53ce
SHA1 793db2fab9ff7077ac26e68fac70b46e10bdeb28
SHA512 89a3214dec844473eda89f824b25bf8e8bf0bd38ac9283443108d5cbafd1eba37ac550537d92585daa8548743d77572de91663474e165a675379f056925e68d7
SSDEEP 12288:Z594+AcL4tBekiuKzErlioTiAu9oU9gPcQp54arl:BL4tBekiuVrcoTLYoOg0cxr
TLSH
T1CD94F0263582C037E16721384FF0C7665A7E79B24B26A4C73BD41B6E6F682E1D63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5360	3510.tmp

Executes dropped EXE 1 IoCs

pid	Process
5360	3510.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3510.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1132 wrote to memory of 5360	1132	2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1132
- C:\Users\Admin\AppData\Local\Temp\3510.tmp
  "C:\Users\Admin\AppData\Local\Temp\3510.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-09-10_9da0877e85c4a0e14954fb4c21cc53ce_elex_mafia_stealc_tofsee.exe 8BE488EF4C7EC7ADA9FE92F0D87C67492B8BD2A33D2DA04ECC8987558CFAE560F38EA52B3BEA2CE69E3D52466D34734E4B7DE2F689DCF0033CD870BB17A588C5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3510.tmp

Path C:\Users\Admin\AppData\Local\Temp\3510.tmp
Size 428KB
SHA256 7bf538402b5e5022844707978728e7384ebc8154b35c1e85dfa4c709ce14dc91
MD5 ce09ed24336c919a5a5eb8888482a67c
SHA1 e2b940d5dd8bc10f0f3ecb7718844cd16bb7f381
SHA512 fefd8721d9d18c29c6b51d592d4c613c655e7ef27423d3c75e7ced096e0bf7ced39e8bf6316fff26aa8e873e7960fac08fcb07ebe547b7427aac139b75f0bce8
SSDEEP 12288:Z594+AcL4tBekiuKzEr4en9yqkHtMjz0Jsvys92+5Dul:BL4tBekiuVr1GeXSbMDu
TLSH
T1D794F1253182C033E2D712384BF5CB6A197EB9A64B16A4C77BD11BBD5EA02D1E73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download