63bb511c3eff8889e1a014bd5fd0a87850676e3c08b63ef3d989c3f111bf95ab

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_2997046d943a52a5d1a735e45a16099f_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260628-3qlbpsgx5x
SHA256 63bb511c3eff8889e1a014bd5fd0a87850676e3c08b63ef3d989c3f111bf95ab
MD5 2997046d943a52a5d1a735e45a16099f
SHA1 2195adfa8b1b14e10a29e6c372da592e9d4edf32
SHA512 bf2addeca028c9e808fbe8a3f1627399c0364e477e1baa12af6d69aeefedf5f22d606d3875856e5a679e0dc25dd87c3aea66737755b088577a2417bb9d7f7bec
SSDEEP 12288:Ci4g+yU+0pAiv+mq1bGBVyqkDNPSas8EB0GK1n:Ci4gXn0pD+h1uoqShSaK0GKN
TLSH
T13794F1313192C033D29615354BE8CBA6667D79654B26A8CB3BD40B7E7EA03D2DB38347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6056	E9AF.tmp

Executes dropped EXE 1 IoCs

pid	Process
6056	E9AF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_2997046d943a52a5d1a735e45a16099f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E9AF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5768 wrote to memory of 6056	5768	2026-06-28_2997046d943a52a5d1a735e45a16099f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_2997046d943a52a5d1a735e45a16099f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_2997046d943a52a5d1a735e45a16099f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5768
- C:\Users\Admin\AppData\Local\Temp\E9AF.tmp
  "C:\Users\Admin\AppData\Local\Temp\E9AF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_2997046d943a52a5d1a735e45a16099f_elex_mafia_stealc_tofsee.exe ABD3F57E62FF2D4D33C5DC555FBC1FA000F887BE26205692138763A224BAF69C492888DBB9DB0493BFD9810D833995D5CDF56F18C836390DCC4AA5CAED71F3F6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6056

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E9AF.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9AF.tmp
Size 433KB
SHA256 f6d962efa639c62e4449f5989ba9caf4091980c8facabb7b800ca30dfb1f344b
MD5 710d85113f1de040a19f8652ee7a9778
SHA1 65a8ecffde1bdb51c2b0680dea7d11f7e7f21c32
SHA512 83856dae6c04d3591b8e8aba1c11e61db2762facb997f63398d1d885e91aac49c00a10706742ab7b330e96602723c22ff08331856ba0abc65b4f2f57d9c4e462
SSDEEP 12288:Ci4g+yU+0pAiv+nJD92Ufh94HMBcf16JKep/ITtn:Ci4gXn0pD+nJD92UTL21Up/C1
TLSH
T19E94E0213182C037E29615388BF5CB6A2A7D79B50726B8CB7BD01BAE2F642D1D634357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download