835eb84c8e088d411d8c1c2eaed74f956ea1898057b324938df232f22d49119e

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 19:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_aca18090e42b585db77f51855391d744_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260628-yma94sdx2m
SHA256 835eb84c8e088d411d8c1c2eaed74f956ea1898057b324938df232f22d49119e
MD5 aca18090e42b585db77f51855391d744
SHA1 0b85e0aa19da98bd92a453bdb097ec910b804f19
SHA512 f7491f173daf3c160b91675403f28c8659180cf6ee81b5bdf3bb56299c89bcfd620b60e488fec7e36a7156cd0a98ce6ca43cb3aaf39f4ffd5949b55f0c2c35c4
SSDEEP 12288:bO4rfItL8HAvgiuidUa2C3L0UNbJTpSDn75UO:bO4rQtGA4iuidUa2SLXNPSDnVUO
TLSH
T13AA4F12A76818133D29302750BE7DBAA663E7975036694C737C8027C1F65BE1D33A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4784	DEC2.tmp

Executes dropped EXE 1 IoCs

pid	Process
4784	DEC2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_aca18090e42b585db77f51855391d744_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DEC2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1524 wrote to memory of 4784	1524	2026-06-28_aca18090e42b585db77f51855391d744_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_aca18090e42b585db77f51855391d744_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_aca18090e42b585db77f51855391d744_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1524
- C:\Users\Admin\AppData\Local\Temp\DEC2.tmp
  "C:\Users\Admin\AppData\Local\Temp\DEC2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_aca18090e42b585db77f51855391d744_elex_mafia_stealc_tofsee.exe 1E02D314662289B897CD706A337223E61AA5DA3E60F5EB291FB3A65DC2436EFC6EB8A708BA82794EA2EA1F72B15ACA1734FFB797301D53537E7979C3FCEDD9E0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4784

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DEC2.tmp

Path C:\Users\Admin\AppData\Local\Temp\DEC2.tmp
Size 479KB
SHA256 cb4ca6a7484482661aa714d8d0f45b102969b267dee5a417d3d5123edfab49c8
MD5 4eacd3a73ffaf21cba4805554efa9078
SHA1 587529d2a91dc9ae5643389a84034276c7c0d9de
SHA512 10f658c5afdb1bb0653561d553bf922554a7cbed9a09d624db8bcb0a6134a80a351a9ed7981c3e66b2620b3c12c060e1d958ab7f15324bc50fbd4ce092af6680
SSDEEP 12288:bO4rfItL8HAQF2I5sty7H0vikgrcu3mHCKBmBYsD75UO:bO4rQtGAQF2I5G6H4zu3mb06sDVUO
TLSH
T1E7A4F1367281C033D29302751BE6DB99A63E78705726A4C73BD8427D1F64AE1D73A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download