788e605501f4e91af6bfa71439aec2ef53751291273fc1eda78696f511785979

Analysis

max time kernel
150s
max time network
133s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260911-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260911-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
12/09/2026, 10:56

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-09-11_41c609a45aa4f04a34039f59615871e1_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260912-m16gmavbpg
SHA256 788e605501f4e91af6bfa71439aec2ef53751291273fc1eda78696f511785979
MD5 41c609a45aa4f04a34039f59615871e1
SHA1 5df6fcd75c9fccfe7982cefbe7ee2d72db123530
SHA512 eac2d6b9033dd70961fc154fbc00607f3947b3471c142da8fae0a191f98fd431a85422f38609fc8f03aea4d797c2767349210547b47fc928e9737ae8aa87490f
SSDEEP 12288:Wq4w/ekieZgU6QpelX+z2M2yb2w/3/kal:Wq4w/ekieH6Qp8OKMdb2w//
TLSH
T10094D0203586C03BE2A616318BE5DB7A657E7DA40B32A8C737D427AD6E742C1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2508	C435.tmp

Executes dropped EXE 1 IoCs

pid	Process
2508	C435.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-09-11_41c609a45aa4f04a34039f59615871e1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C435.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3376 wrote to memory of 2508	3376	2026-09-11_41c609a45aa4f04a34039f59615871e1_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-09-11_41c609a45aa4f04a34039f59615871e1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-09-11_41c609a45aa4f04a34039f59615871e1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3376
- C:\Users\Admin\AppData\Local\Temp\C435.tmp
  "C:\Users\Admin\AppData\Local\Temp\C435.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-09-11_41c609a45aa4f04a34039f59615871e1_elex_mafia_stealc_tofsee.exe CAD5AF45A0E9AC7B6DA2B555356D8AC3BE8801A8EC8B86B9D3F0EA667FCF7A1A58157E2A8F462CFD0EC92CE16DD62804DFF1D5849D7FEFA0F9C5208F8CE0B554
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C435.tmp

Path C:\Users\Admin\AppData\Local\Temp\C435.tmp
Size 414KB
SHA256 ca4048a8e486b5ad5cf73e01b6dd82a46ca2bc7fde5637756f73f2f798fc8c0a
MD5 55ba9a639ef23244d21489c5285cb945
SHA1 d55c8ae5e3e729fe6cf5af13a14dc8523f969225
SHA512 1e943eafde6798ed6e80dba733bfcace60b7d3f5a4b88513cb71a1348b68f8daee92e9574178d267c940d9bed4a50fde51df096533a0a2205aa5478a693ae1a6
SSDEEP 12288:Wq4w/ekieZgU6LkWRUkSEWDbnr43MIo1F7yXaNmwQL2l:Wq4w/ekieH6/evE8vtwsmHK
TLSH
T1F194E0207582C036E2A706784BE1C7BA653EBD644B36A8C73BD42BAE5E742D1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download