04811fc942374fa9155b1998d8185283c9840e4054e987417451b98c179b34a3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 18:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_d55256c61e0581ffa63df3951e9f79a7_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260628-xf2caacv5n
SHA256 04811fc942374fa9155b1998d8185283c9840e4054e987417451b98c179b34a3
MD5 d55256c61e0581ffa63df3951e9f79a7
SHA1 b69677f896e5d9935bc5956505d6704436e01ac8
SHA512 d06afe686d20f65d378b0bab8b4603350e378a73f9e8d17614121d3eb4269dc6b99caa9b69955f7e64a5f2ff8d3fd2a201ffb7063d09892f908f59e40df4699c
SSDEEP 12288:aO4rfItL8HRw0Qy/siphGenr2TMGwF/1sD0NqN7K9wlsDpVFd:aO4rQtGRwp6r2M7S0s+9wlsDpVFd
TLSH
T1F0A4F13A76828233D29302705BE6D79AB73E74B01765A8C337D4027D2E66AE1D736347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2208	F335.tmp

Executes dropped EXE 1 IoCs

pid	Process
2208	F335.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_d55256c61e0581ffa63df3951e9f79a7_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F335.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1716 wrote to memory of 2208	1716	2026-06-28_d55256c61e0581ffa63df3951e9f79a7_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_d55256c61e0581ffa63df3951e9f79a7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_d55256c61e0581ffa63df3951e9f79a7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1716
- C:\Users\Admin\AppData\Local\Temp\F335.tmp
  "C:\Users\Admin\AppData\Local\Temp\F335.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_d55256c61e0581ffa63df3951e9f79a7_elex_mafia_stealc_tofsee.exe 62715D429E2572F4B0FA79EC779AF4B1DAE42988E7E5FF63B3459BD2570DD769AEF1656002443FE9CD00748C1A9C4ABD09B0580083BE8D74D56A3CCC368288FB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F335.tmp

Path C:\Users\Admin\AppData\Local\Temp\F335.tmp
Size 476KB
SHA256 9c116414025ff7c617c300ab6515e9f6390661ed7473d927f51c4975c9c526cc
MD5 29094ee11c95fc8a6cd2d676be664476
SHA1 26990437d93b2ccf2857a75bb4a607bf02ad9c55
SHA512 14e8343bc4086b22ab1a48392301eaceb7153d78bffddaf7e4ee286d2fb0f581b34bca1aace8d806a6c256bcac569ea3de26bb86998e1c5edc2ad61a23eab83d
SSDEEP 12288:aO4rfItL8HRX6BDdnPDOhpLFF6QsMNrWkXVa7K9wlsDpVFd:aO4rQtGRXEZPCSQDR2+9wlsDpVFd
TLSH
T17FA4F12AB681C233D2A302710BD6DADAA63E75750726A4C33BD4037D1F656E0D37A35B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download