4bb69c5c7d4ca414c13743a94d4b0f5bdda7d4114625efc18a18164f211cf5cc

Analysis

max time kernel
148s
max time network
151s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 20:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_a5044c6c4d93903578e5fde8e107dd54_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260628-yvm9msdy9m
SHA256 4bb69c5c7d4ca414c13743a94d4b0f5bdda7d4114625efc18a18164f211cf5cc
MD5 a5044c6c4d93903578e5fde8e107dd54
SHA1 1d03df0ca1e4937e7282a2211261ebe348b0667d
SHA512 c14cc1b8d9b2195455de0c0933c753de4427d702621d9815fd3d880369451c17b4095e1ee485d6ed0fc45e799d471aac5054c496f6b664f485e369ea85814fde
SSDEEP 12288:bO4rfItL8HA730l1XETCh2C+3cWAdbcmkUi75UO:bO4rQtGArAFQD3cXZ7iVUO
TLSH
T171A4F12AB681C133D29302754BDADBA6B63E75700726A4C73BD4063D1FA1AE1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2456	E9FD.tmp

Executes dropped EXE 1 IoCs

pid	Process
2456	E9FD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_a5044c6c4d93903578e5fde8e107dd54_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E9FD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5100 wrote to memory of 2456	5100	2026-06-28_a5044c6c4d93903578e5fde8e107dd54_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_a5044c6c4d93903578e5fde8e107dd54_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_a5044c6c4d93903578e5fde8e107dd54_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5100
- C:\Users\Admin\AppData\Local\Temp\E9FD.tmp
  "C:\Users\Admin\AppData\Local\Temp\E9FD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_a5044c6c4d93903578e5fde8e107dd54_elex_mafia_stealc_tofsee.exe 51578F5893A077094D568391FD2A2E8F27EE53194F233B3D4875DF825FD4BBD4CC062CBAC43BEE75321ABDC625FF2808436CDF7FF29729CC3A9309F0F7845F32
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2456

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E9FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9FD.tmp
Size 479KB
SHA256 a24f0114b6f85be7a076369d7ef8e2e2c7a53325bcbc2a64d9cd78b1d7559db0
MD5 6e514537240f488bf51309b3a2110a95
SHA1 69d939040c0ba72f27eea38fe41c280b6157c75c
SHA512 144974006b1332cf6e7410e87544e6d8d89fa74754d3c02e77acaf116c697b4f63829630c97a5e73855a472a1442c28bcd69fb53fa889470c481f7acd8ac8240
SSDEEP 12288:bO4rfItL8HAWcJU09Yw4cjQEcQKvF75UO:bO4rQtGA/JU0yw4cxRKvFVUO
TLSH
T11DA4F12A7681C133D29302315BEADB9AB73E35750B2694C33BD4066E1FA0AE1D776347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download