e64c88c9213d7f31d576a06a4ff27eff76b2ef510a7f76ca3b5fb973d9b8e94f

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 21:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_6bdd6f41155d0f16952eac8bbafafc09_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260628-1sa8eaez2y
SHA256 e64c88c9213d7f31d576a06a4ff27eff76b2ef510a7f76ca3b5fb973d9b8e94f
MD5 6bdd6f41155d0f16952eac8bbafafc09
SHA1 8d09d3314c95ce05cbd89beaa3c05f579992aea5
SHA512 c386c4625327b0d4f0c74669329fbcdb5525ca3e3027077f25773a1162d00e6d724d211a8cbdac286d06d4f024ee7230184e6c008fa3cbe097ba3aed91a16567
SSDEEP 12288:NW48Uekie0ghBlzj9wp+RwpsVydFeInbG4HWaSA:NW48Uekie/Bl+oRwSUe2bGGWa
TLSH
T14B94E0313682C037D6E216384AE1DBA9697A7DB14B31A4C737D02BAE5E742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4344	3E09.tmp

Executes dropped EXE 1 IoCs

pid	Process
4344	3E09.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_6bdd6f41155d0f16952eac8bbafafc09_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3E09.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5992 wrote to memory of 4344	5992	2026-06-28_6bdd6f41155d0f16952eac8bbafafc09_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_6bdd6f41155d0f16952eac8bbafafc09_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_6bdd6f41155d0f16952eac8bbafafc09_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5992
- C:\Users\Admin\AppData\Local\Temp\3E09.tmp
  "C:\Users\Admin\AppData\Local\Temp\3E09.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_6bdd6f41155d0f16952eac8bbafafc09_elex_mafia_stealc_tofsee.exe 8570B6C499F875A499C0A2CCA216803C971ACB79406F6A972ED220F7FBCE3106A1BB52363FE95EAE38C4FAEB0D621E76FA62FBD69F9B7B5E7E16F4A0F27B3A91
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4344

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3E09.tmp

Path C:\Users\Admin\AppData\Local\Temp\3E09.tmp
Size 435KB
SHA256 197533f2e3707cfb6b2e8c5b30ebdfd154947e9123c8cb4ed919f3e757b37143
MD5 ad58cf867d48832033e0fd3e94298877
SHA1 3097e2297d6c25a0a37e915c652d383d15ef4ab4
SHA512 c61cd9e194a5f456e3513c4fa841270a7b64de2b66ff47a7b6a37300cf2642ec266921b3e6d7a996beb801b9b8e47b136308e5d465f406e192fdaef1b50c7cae
SSDEEP 12288:NW48Uekie0ghBSyoyRf61rPe524HWaSA:NW48Uekie/BSEfeGWa
TLSH
T12594E1213682C037E2A615384BF5CBBA29797DA44B35A4C73BD427AA2F741D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download