209ee82357cdbc93b03ded978e9b263d0bc69c01b18ca0996d312449b9d2cc7c

Analysis

max time kernel
148s
max time network
152s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 22:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_5376c93733a56d80bf9efe19726d5007_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260628-2jsa1afw7w
SHA256 209ee82357cdbc93b03ded978e9b263d0bc69c01b18ca0996d312449b9d2cc7c
MD5 5376c93733a56d80bf9efe19726d5007
SHA1 dc9dc0b9a6b23d65cf240c8cb220b2064c729722
SHA512 41550a3dfd68a99cc47245d2a9fe04491cad8a4b4a9d3d471c370b467f653b704784cdc6550be670cd9b3f203428b1bf428ddc09750c59bf2160112c2a697c91
SSDEEP 12288:3O4rfItL8HP5JgPG0uE9xWHgAh+BSgM/MJxis7rKxUYXhW:3O4rQtGP5JgG6zWH4bIs3KxUYXhW
TLSH
T160B4E126B282C233D39302711BD69BA9A73D7970173694C33BD4427D1F62AE1D77A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2724	16.tmp

Executes dropped EXE 1 IoCs

pid	Process
2724	16.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_5376c93733a56d80bf9efe19726d5007_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5124 wrote to memory of 2724	5124	2026-06-28_5376c93733a56d80bf9efe19726d5007_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_5376c93733a56d80bf9efe19726d5007_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_5376c93733a56d80bf9efe19726d5007_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5124
- C:\Users\Admin\AppData\Local\Temp\16.tmp
  "C:\Users\Admin\AppData\Local\Temp\16.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_5376c93733a56d80bf9efe19726d5007_elex_mafia_stealc_tofsee.exe 708D2AC9705DD2BCB383FFB577147BD16EDCFCA153EC2088FAE9F1E2039B5CED1D77A8D7A82F9F01ABEF93F45F625823EC5D9E89DE9EEC17317047E7D22758ED
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2724

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16.tmp

Path C:\Users\Admin\AppData\Local\Temp\16.tmp
Size 486KB
SHA256 6b05ced2cb59f6df8d5cccb07183c58097f7529cd282eb6a756e6e82336f4d8c
MD5 95c94561fa794c6f1ffbd81bc3ff4c33
SHA1 00a390cfe7d3c3a505119322ccb1f7648240a431
SHA512 e0562b40af718f3be464769a219e2d051d3727660c95782fc7f9fdf6a5e239261b9499ece512cd7883db1c57669f1e6a7748a467cd4b20b9eec57d8236dbb83a
SSDEEP 12288:3O4rfItL8HPPxgxXF25w7qkqn1yIjxLCLx4aVFnNc7rKxUYXhW:3O4rQtGPPgF4b1ySxq+k7c3KxUYXhW
TLSH
T1C2B4E129B6818233D1D301710BD6DBD6BA3E75B50376A4C3378802BD1FA56E1D77A38A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download