21235d5a15a9f4d7da96ead9866fa2ad94911c3390d18f13a1a5223af6d62ed5

Analysis

max time kernel
148s
max time network
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 00:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_1ae0a7bb110fcc83493e7c0d36172e1f_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260629-aef9dsg13x
SHA256 21235d5a15a9f4d7da96ead9866fa2ad94911c3390d18f13a1a5223af6d62ed5
MD5 1ae0a7bb110fcc83493e7c0d36172e1f
SHA1 21f5d99b96411629a9b6d8e066f12c1af1b75f9b
SHA512 5be6763f1c37654d769a2b8fe399e8b4c0b50dd59622b66a89cc5ef8b29a5b5706fb5d7270c64f91363e8a36ff5c3a8c38e32c3158aaf30b1694136cf6c07919
SSDEEP 12288:qO4rfItL8HGKM5cXCUNykuxkLuzrIUxDsw7bWmeEVGL:qO4rQtGGKMWryLxx/IUxDzumeEVGL
TLSH
T111A4F12A7681C133C2A302751BE6DBA6A63E75B41722A4C37BD4437E1F646E1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4080	B7D2.tmp

Executes dropped EXE 1 IoCs

pid	Process
4080	B7D2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_1ae0a7bb110fcc83493e7c0d36172e1f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B7D2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1420 wrote to memory of 4080	1420	2026-06-28_1ae0a7bb110fcc83493e7c0d36172e1f_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_1ae0a7bb110fcc83493e7c0d36172e1f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_1ae0a7bb110fcc83493e7c0d36172e1f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1420
- C:\Users\Admin\AppData\Local\Temp\B7D2.tmp
  "C:\Users\Admin\AppData\Local\Temp\B7D2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-28_1ae0a7bb110fcc83493e7c0d36172e1f_elex_mafia_stealc_tofsee.exe 5B1986524F24EF95EDA928317E1BC6E4B47F01F39779B08B7B75D742CF2C1EDFC4B6B1A41E227B6648A9F258C71D571116723209DD34E06FDC4954A06F0A8A98
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4080

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B7D2.tmp

Path C:\Users\Admin\AppData\Local\Temp\B7D2.tmp
Size 468KB
SHA256 7011dd622a28f4d7db5ec4e05507045957c4b25bf4bafc2069574fbe50a07a76
MD5 32c686017e34287db7aa7ec6d7303ada
SHA1 a970e21ab808e0972bad3948d5ea25d6e22d021a
SHA512 44c99bbb035bc2b42158927f5638517b163cc73a16ad2b49a73379231c9b3954189e098cea757077b41bec4187a8a1f943485108bfb6fd81a82ee0dd6f6130c8
SSDEEP 12288:qO4rfItL8HGpsWZfLiNhzyrFJvuDjSfHIw45W7v7bWmeEVGL:qO4rQtGG6WZfLqzyv6WfoFW7vumeEVGL
TLSH
T17AA4E02A7241C133D29302750BE6DBA6BB3A74B44326A4C737D8067D1F666D1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download