5a6399975cb7ac51a53a0753c3b62afc0802e976e30c9fdc37d47ce53690c277

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 21:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_7ab3ad4dabe26a6a9ed5f20161d8b72c_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260628-1bgnvsfs5q
SHA256 5a6399975cb7ac51a53a0753c3b62afc0802e976e30c9fdc37d47ce53690c277
MD5 7ab3ad4dabe26a6a9ed5f20161d8b72c
SHA1 7593940e5511dff2f8facb3680911d853e198620
SHA512 2f9efc0649b6e4c4ad13a667ad182c238487929bcfb8b687b54992527853633e9cbd9eeb0d01bc3395d1d166db987d0bd3ab1e34513e2b2a86191f92101b7790
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStz8w3hq+AC6AWqJ+I+6qDkjidixqsEFf5s/Y:Nb4bZudi79Lq++N6AWhB5diJRAJFcA
TLSH
T1F3A4F1243581C033E2A716344FF6D766653E79A24F2268C737E46BAD2EB02E2D634357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3432	3BF.tmp

Executes dropped EXE 1 IoCs

pid	Process
3432	3BF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3BF.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_7ab3ad4dabe26a6a9ed5f20161d8b72c_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3236 wrote to memory of 3432	3236	2026-06-28_7ab3ad4dabe26a6a9ed5f20161d8b72c_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_7ab3ad4dabe26a6a9ed5f20161d8b72c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_7ab3ad4dabe26a6a9ed5f20161d8b72c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3236
- C:\Users\Admin\AppData\Local\Temp\3BF.tmp
  "C:\Users\Admin\AppData\Local\Temp\3BF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_7ab3ad4dabe26a6a9ed5f20161d8b72c_elex_mafia_stealc_tofsee.exe 04FD35CE3F61165B4B5F5CEFE86D9CAC4AC2FE22C593C85E43E9BBB8E1D2CD35476B3855252E3F1E0B18145A8C179071BF98384B046730E7331A031DE2570B48
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3432

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3BF.tmp

Path C:\Users\Admin\AppData\Local\Temp\3BF.tmp
Size 444KB
SHA256 5e43879ce730c2d1e12509c7378946a421ad99c9dc72dfa5888c2bcf4d007a4e
MD5 49fbc3cb7b903587bd9447d427d6feaf
SHA1 c92779a127ca052b143d3c53ab3760828b001cbc
SHA512 0b817e49b866b58722a3ccaf1eceb328fd7e81e5367e28071bc43ef3388fb7f600b33cba61098ecdc613b08f53584112cf269b8285b36467c354426a2afbabc7
SSDEEP 12288:Nb4bZudi79LsnUOogSZEtm18fWkO6lmK5YoY0CA:Nb4bcdkLsnbkQm17kOsYo
TLSH
T1F1A4E1243682C03BE15712384EFAC775257E3AA15B26B8C73B846B6E1EB02D1D731357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download