5d7cf71b24c1c8d042664d3594859dcfe45f9425c4fdfcec41bb11a2148ffe98

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5fc9b2a3a27c09b1c95e7aeacaf1f1fc_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260628-16feaafs5t
SHA256 5d7cf71b24c1c8d042664d3594859dcfe45f9425c4fdfcec41bb11a2148ffe98
MD5 5fc9b2a3a27c09b1c95e7aeacaf1f1fc
SHA1 881ee9c1a61d2cb6289cda28953f4c6a35d6e7ac
SHA512 c4f5fb4a8415f444910d69d925c22ebc0fc596fbef0c50348c9c1abfadfef9e26e0c69fd451f47e1e2b13beb8d851c05bd6a4e210c63ecbb54211eea9e62084a
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYSb0NkCIZ7UOPB06wfzvj7Fsxf4dKCHXllMa:Wq4w/ekieZgU6HZoWmpz1st4R3llMa
TLSH
T15FA4D0253186C036E16706344AE5DAF9593A7DA14F72A8C73BD03BAE6E706D1DB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5884	2476.tmp

Executes dropped EXE 1 IoCs

pid	Process
5884	2476.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5fc9b2a3a27c09b1c95e7aeacaf1f1fc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2476.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5696 wrote to memory of 5884	5696	2026-06-28_5fc9b2a3a27c09b1c95e7aeacaf1f1fc_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5fc9b2a3a27c09b1c95e7aeacaf1f1fc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5fc9b2a3a27c09b1c95e7aeacaf1f1fc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5696
- C:\Users\Admin\AppData\Local\Temp\2476.tmp
  "C:\Users\Admin\AppData\Local\Temp\2476.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_5fc9b2a3a27c09b1c95e7aeacaf1f1fc_elex_mafia_stealc_tofsee.exe D1674892591ACD05D3B898A27B1A046DB03286920F5C202308CF82674568FBDF39985FF57248A2D05DEF5DB964005E07879E133ADB3E655077D485A4A2043A66
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2476.tmp

Path C:\Users\Admin\AppData\Local\Temp\2476.tmp
Size 443KB
SHA256 3a26c7b2fb5dfda01aaa1e15ae03ff36e0f66e5051aa7afd45e63980d300e78b
MD5 f26ca89bf9ce96acee38258b6b90c9d6
SHA1 d249055bd0958929d30f3206d00d1644072d3d9e
SHA512 95583d0f309aa51a6aea956f179ecf101181b3d1c3ec9aae8eb65f21f655df97e1871ec7531103545855d8ffe6e44194d9af5e0030e67549fb3cb247daa438f5
SSDEEP 12288:Wq4w/ekieZgU6XESLupMooDEkaSC3clMa:Wq4w/ekieH63y8amP
TLSH
T189A4DF307592C036E16716348AE5CAA95A3ABD714F75A4C73BD03BAE6E702D1CB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download