ef662338d00c3281476d8bfff3a57f4cea0b3e442cfd329a88aa4a941d34042a

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_331e8dc73e654e8e5e20d610ae2e9e39_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260628-3gfd4ahs7l
SHA256 ef662338d00c3281476d8bfff3a57f4cea0b3e442cfd329a88aa4a941d34042a
MD5 331e8dc73e654e8e5e20d610ae2e9e39
SHA1 a75eecbf95807a3456610b2f123d82c46eda07fa
SHA512 714de4dca2f25331bf11a57ad0ecb047ced0183302639a839be9b89baf345f25fc225d56412c286145e6493c948325a9489137334532bd040c96a3ef012115f5
SSDEEP 12288:Nb4bZudi79LRbYNFPmP2e63pDffXJHa6LVMJKA0a:Nb4bcdkLRbKPmP2xJfhHBMJh
TLSH
T168A4E0103682C037E2A706354AE5CBB5663E7DA15F7268C73B903BAD1EB02E1DA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3692	6AD.tmp

Executes dropped EXE 1 IoCs

pid	Process
3692	6AD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_331e8dc73e654e8e5e20d610ae2e9e39_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6AD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1448 wrote to memory of 3692	1448	2026-06-28_331e8dc73e654e8e5e20d610ae2e9e39_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_331e8dc73e654e8e5e20d610ae2e9e39_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_331e8dc73e654e8e5e20d610ae2e9e39_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1448
- C:\Users\Admin\AppData\Local\Temp\6AD.tmp
  "C:\Users\Admin\AppData\Local\Temp\6AD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_331e8dc73e654e8e5e20d610ae2e9e39_elex_mafia_stealc_tofsee.exe 13ADC73159449C75FED2C78837642879B23510FCCB677DC891E4A3A1C6B4E8D1A1CEC043A59188B257E9979B7B666BA680233CD19F1AFF297E2010D95DABD4F8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6AD.tmp

Path C:\Users\Admin\AppData\Local\Temp\6AD.tmp
Size 473KB
SHA256 c92198eacf52042104fd0e7c9f60bd1ed1f03a5b00d335b1b9b7ee2eebe0d728
MD5 6f52a836d096dc6032430a60053a226c
SHA1 49db0cec4e11eeb2ad7f402a229ef3f54cb0cabf
SHA512 e8c25b40de34c6d5a6c0bc398c33754751180118e4cc7d577fe14e53464d85e77e997beb4dee5b260df7874950f357bdbe515c707eda5610adf35f75ae58a9b2
SSDEEP 12288:Nb4bZudi79LnlWeH7Gal+AxyQm3WYsrGEYHvA0a:Nb4bcdkLIARLx/dYSlga
TLSH
T112A4F1243181C037E29712354AF5C7B5667A7CA15F6268CB3BD03BAD6EB06E2D634327
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download