fc6336f1958b14f1e1229446f8113328c0466c4c5b80d4ff816c3ce90429cd2e

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5b724fb6cb584da2c23dc9de11b6ffc9_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260628-2a17jsft6w
SHA256 fc6336f1958b14f1e1229446f8113328c0466c4c5b80d4ff816c3ce90429cd2e
MD5 5b724fb6cb584da2c23dc9de11b6ffc9
SHA1 d95a814cabe0cd640e0ff1c9b1a61ee8e9ab87f3
SHA512 bdfc7cdc5eec75e53e94ad6f94a4110f10bbf6ecb66f1a354bf78476b8550885caee2e2747d613cbf219e27f458b15e81730b7cdd27965db0f949b49f217f1b4
SSDEEP 12288:fd4x+ePixnXQj0ZIhjgSXVLwOAWmj7GDnbMyRwP:fd4x+ePixAjRgYLwOIfGD9R
TLSH
T10694E0213586C032E2E305354BE1DB69693A7DA40B32A4C73BD427BE6E752D1DB3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5568	2D50.tmp

Executes dropped EXE 1 IoCs

pid	Process
5568	2D50.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5b724fb6cb584da2c23dc9de11b6ffc9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2D50.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 5568	948	2026-06-28_5b724fb6cb584da2c23dc9de11b6ffc9_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b724fb6cb584da2c23dc9de11b6ffc9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5b724fb6cb584da2c23dc9de11b6ffc9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:948
- C:\Users\Admin\AppData\Local\Temp\2D50.tmp
  "C:\Users\Admin\AppData\Local\Temp\2D50.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_5b724fb6cb584da2c23dc9de11b6ffc9_elex_mafia_stealc_tofsee.exe F6106C5A95B9698017A2E6252A18187A50D80F1A75DFCA865B8D569D2A00A2609F5C68E3E77CC1737CAF95F65686882D0C2D7B2119C0C9C10097FE5FD9B86C73
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5568

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2D50.tmp

Path C:\Users\Admin\AppData\Local\Temp\2D50.tmp
Size 435KB
SHA256 b42e36638bfcafe351d6d6f7e280e1dfc0a0bc94d128fa5816a18a6f3375df25
MD5 a9762b610036c2f39c0d45698a3b5c43
SHA1 af542c4f28d48cb5e5d236014d4994722b9b9d09
SHA512 bc06e3e768df9b2983faad8ed7f4667099c702a3e3e7bb915809bc6ff4cd8657b07bc569d47d99c728de618f336c548740f890a278bfcbd2a4a2a05c91a0622d
SSDEEP 12288:fd4x+ePixnXQjcLL3to2ujhohzXnMowP:fd4x+ePixAjcLxoHjhmDnMo
TLSH
T10994E0203546C037E1A605384BF5CBA9997E7D704B72A8C73BD427AE5E702D2DA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download