ba90e811f7f4ee54c9699a123f34d19116c4588cef7105a9c591d3e0140c6aa8

Analysis

max time kernel
150s
max time network
136s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 23:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_250d634b5a7587417ddf24249b60b328_elex_mafia_stealc_tofsee.exe
Size 441KB
Sample260628-3vae1ahw3n
SHA256 ba90e811f7f4ee54c9699a123f34d19116c4588cef7105a9c591d3e0140c6aa8
MD5 250d634b5a7587417ddf24249b60b328
SHA1 cd61f85ca3876dbd3fd15e938017d0524d95997b
SHA512 7caf71a6f7da34d90f7240b4d9110bc06811818d12b9c2e0e0209f2d9d6f0fb8b713bbea82a730fdbaede478a2fed67c56e2c2531f866d3a20fcf18ce9c956b0
SSDEEP 12288:6i4ET7+0pAiv+9G4gJIm5VGPoarBCr8f/Gu+TXQeWzQc:6i4ETK0pD+irePoarB++yrQeeX
TLSH
T1FCA4D0207241C036D39B1A344BF5CAB9657EB4644751A8CB3BF4CBAF7E646D1AA3430E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2508	16BA.tmp

Executes dropped EXE 1 IoCs

pid	Process
2508	16BA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_250d634b5a7587417ddf24249b60b328_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	16BA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1936 wrote to memory of 2508	1936	2026-06-28_250d634b5a7587417ddf24249b60b328_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_250d634b5a7587417ddf24249b60b328_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_250d634b5a7587417ddf24249b60b328_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1936
- C:\Users\Admin\AppData\Local\Temp\16BA.tmp
  "C:\Users\Admin\AppData\Local\Temp\16BA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_250d634b5a7587417ddf24249b60b328_elex_mafia_stealc_tofsee.exe DADC1319D057FBF7BAE47707D232B6493F61FA0D19B104B5C9AEAA9D51E12902D6E71971B4BCFEE98B81417079F2F3D363CEBCB0ADDD13C0C1160A5FB8472B73
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2508

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

16BA.tmp

Path C:\Users\Admin\AppData\Local\Temp\16BA.tmp
Size 441KB
SHA256 b61c7eecc3676287e55d232d04811fb0ccc46baa8eb0af18cf2b85a66c309246
MD5 f5d8ca396b40ef8d8bdb980baea4f98f
SHA1 173615f018da87b08587f740188e86489a57bdeb
SHA512 66a4dd4f5cb2d6cea9bbed8fb83534a6cce04b11e82b76c50a5a817a01a844c443a0f02422d56de4db9501928220f2dfbcd466d208507bd6253774fbd2657a5b
SSDEEP 12288:6i4ET7+0pAiv+pLDfAT91Ripgobke2MPH7mFc:6i4ETK0pD+NUZyXHn
TLSH
T172A4D0217245C033D2AB0A300FE5CB79617F75654761A8CB3BB4CA6E6EA56D1EA3430F
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1936-0-0x0000000000420000-0x0000000000497000-memory.dmp

Download

memory/1936-7-0x0000000000420000-0x0000000000497000-memory.dmp

Download

memory/2508-5-0x0000000000AF0000-0x0000000000B67000-memory.dmp

Download

memory/2508-8-0x0000000000AF0000-0x0000000000B67000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads