e6cb099fa313e9b1e51607fd2bd005b7c556db92979092a4e95f6ce76774eeb1

Analysis

max time kernel
148s
max time network
149s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_3cf3f59eab00c7421703ff2cf5c83adc_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260628-261kwsf18z
SHA256 e6cb099fa313e9b1e51607fd2bd005b7c556db92979092a4e95f6ce76774eeb1
MD5 3cf3f59eab00c7421703ff2cf5c83adc
SHA1 dc008bfe7552f1aaa26c9c3940d4f28c11b8f553
SHA512 1be5132f16e62c5c86b79b1039e5d6132808d7383aead480002c68dea4dc1b8e2fc71773bf03d862bf40e1916322fab7d3611758765fe1054965248dc9fef0b5
SSDEEP 12288:fd4x+ePixnXQjbgP2gn4zVxOGwz1zY1fR8PEdPKAwP:fd4x+ePixAj8P2LRgDz1cMPEdz
TLSH
T1E094E1203282C037E1A716384BE5CB6A593D7DB44B36A4C77BC42BAA5E742D1DB3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1536	E347.tmp

Executes dropped EXE 1 IoCs

pid	Process
1536	E347.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_3cf3f59eab00c7421703ff2cf5c83adc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E347.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2928 wrote to memory of 1536	2928	2026-06-28_3cf3f59eab00c7421703ff2cf5c83adc_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_3cf3f59eab00c7421703ff2cf5c83adc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_3cf3f59eab00c7421703ff2cf5c83adc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2928
- C:\Users\Admin\AppData\Local\Temp\E347.tmp
  "C:\Users\Admin\AppData\Local\Temp\E347.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_3cf3f59eab00c7421703ff2cf5c83adc_elex_mafia_stealc_tofsee.exe F59A6683EBF8AF2B186A02F51FBC8FD87B32476137F70FFAB68A4FEBDD93484AAEBCC27A8F6CD30A78B0D61F7CB24AFFC9D7BCECF279E9A80AA3A6709252B552
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E347.tmp

Path C:\Users\Admin\AppData\Local\Temp\E347.tmp
Size 435KB
SHA256 5c143856ffdbf8c2776691057bbefe5131e83ee479026b543689b22348ad1396
MD5 68f52a50de180aa40605c22644d9835e
SHA1 9a3357c73fddbccece50f588c2d5f9898f6a7669
SHA512 5019c90ee4b9a6b030e2262e34631a1b42f3eff5b6155c7279feed667644a8df195a7f899a8a25f5673b9df3fd68d12d9c73efcff877cf681e756acc72ac2a45
SSDEEP 12288:fd4x+ePixnXQjXQZOKPv50GXZPZKAwFp0wP:fd4x+ePixAjqHeGBZKHF2
TLSH
T1C294E0213686C037E2A705348BE5DBA959797DB04B32A8C73BD42BAA5F706D1DB30347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download