e9e85bc65cd1b3f94c767a0e9df5b6639b72daf24614d0f8e0158086be9dbc19

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_3b5e727e79cc642e4aa9bf3cba4ba6f7_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260628-28ndcags4w
SHA256 e9e85bc65cd1b3f94c767a0e9df5b6639b72daf24614d0f8e0158086be9dbc19
MD5 3b5e727e79cc642e4aa9bf3cba4ba6f7
SHA1 c346595aa7759bf8ddae12961d9b98b993fe96d2
SHA512 4d340c12273249f90b77fc1e55ba464fb85bed92eb056e8f4cce475f2d750c8a8967459615f596a8680a324909731b32b590e1e5d22ac08409c12d33f714a6f5
SSDEEP 12288:Z594+AcL4tBekiuKzEr0ogdgIspvP+5qoqFHbyyl:BL4tBekiuVr3I8vPYqoebR
TLSH
T1A194F0303185C037D2A712384BE9CB6A5A7F79B50B25A8CB3BD41B7D5EA46D2C63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1380	E366.tmp

Executes dropped EXE 1 IoCs

pid	Process
1380	E366.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_3b5e727e79cc642e4aa9bf3cba4ba6f7_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E366.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1884 wrote to memory of 1380	1884	2026-06-28_3b5e727e79cc642e4aa9bf3cba4ba6f7_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_3b5e727e79cc642e4aa9bf3cba4ba6f7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_3b5e727e79cc642e4aa9bf3cba4ba6f7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1884
- C:\Users\Admin\AppData\Local\Temp\E366.tmp
  "C:\Users\Admin\AppData\Local\Temp\E366.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_3b5e727e79cc642e4aa9bf3cba4ba6f7_elex_mafia_stealc_tofsee.exe D32916BFCE25F8497D7F23A89A560238FECE674B13F857AB413453C75C65F4D9F7F3BCCB9DAA51D0C79AACAFB9811DDD4B008E1CB2DBC9F3E938B9E96404DCA6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E366.tmp

Path C:\Users\Admin\AppData\Local\Temp\E366.tmp
Size 428KB
SHA256 590cf3494d8af5e32126913888e05315ade0aac486d8c1f1db63e5fd14f9aabb
MD5 fc03f1b0fd2f4d4183bdb92a27ce4dea
SHA1 04066fd588c6eb6f4beefc6d22063d69bb551502
SHA512 d11ab0a5cfa055b891bde0a7bfb0a91961b9b829ccb4386abc330839e364b2b7b01918b387006510e64cc3a151af69746cbf9f4a069d87b1f2e7ada5f655e2f9
SSDEEP 12288:Z594+AcL4tBekiuKzErACJ4vst5R2k7KZZkLNJizqYfK0SF5l:BL4tBekiuVrAu4Q51WSSqb0SF5
TLSH
T11F94F0313141C032E6A71A394BF5CB66597E78B24B26A8CB3BD01B7E6E642D1E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download