e8fd87e4de58c5062aa38b0c9f4154c1eb3329c83164fd241f43ad115465df3c

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/06/2026, 20:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_9657b0da84f2bc09d0e86662734e6a69_elex_mafia_stealc.exe
Size 435KB
Sample260628-zagf2adw7y
SHA256 e8fd87e4de58c5062aa38b0c9f4154c1eb3329c83164fd241f43ad115465df3c
MD5 9657b0da84f2bc09d0e86662734e6a69
SHA1 3ad47fa7f99e2c2b4e57a31f1ea8bee90b6c78f4
SHA512 7220b238bc3de89c50fd434af38263af297de1d3b03c6a0d2d7f94899707e7e77ead337c35bd7239cb7cfbfdf942fe0098ce3bf8a27a4451bcf3b9eec3930845
SSDEEP 12288:9W4ufepiqKQ1mblBuBjdDSB3E95aEpjmPZVJ:9W4ufepiqhmbl8PiQZp6ZV
TLSH
T16D94E0257186C036E1A205384BF6DB6969397DB04B31A8C73BD42BAF6E742C1DB3135B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1860	FD5.tmp

Executes dropped EXE 1 IoCs

pid	Process
1860	FD5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FD5.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_9657b0da84f2bc09d0e86662734e6a69_elex_mafia_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 1860	3144	2026-06-28_9657b0da84f2bc09d0e86662734e6a69_elex_mafia_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-28_9657b0da84f2bc09d0e86662734e6a69_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_9657b0da84f2bc09d0e86662734e6a69_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\FD5.tmp
  "C:\Users\Admin\AppData\Local\Temp\FD5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_9657b0da84f2bc09d0e86662734e6a69_elex_mafia_stealc.exe 8120C7B96E12B4CE57E587DF3FB68B6F980027A3C54152E29D51C8593B87CB8D16854E1405488366BD6BFFCB627E37C45CB7B9255FD6C5E90B581E9CFEA09645
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1860

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FD5.tmp

Path C:\Users\Admin\AppData\Local\Temp\FD5.tmp
Size 435KB
SHA256 eee77c5b97de2b4c9f1cf5b4a3a9199cd8f98f247ae5e5a8164f7b5b25109167
MD5 0d41ccf7b7ea3a92d18b8071be4d84f2
SHA1 5cca1fdec24dd72efa6a1e5898499dc130c6ddd8
SHA512 74c137630d4034cb1cd5599639b97e80be53ed1466db60e3aa99d6cfd699fcaa2c3971961e75725dd108c93450bffe30ddfa1843f3b4aecaba98fe3f94897780
SSDEEP 12288:9W4ufepiqKQ1mU/UacLgmknm02T/8vwq4J:9W4ufepiqhmUfm02T/8vwq4
TLSH
T11794E0203682C037E2A716358BF1DA69593D3DA44B36A4C33BC427AE6F746D1DA3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download