e72c7f8fd64cf32e120d4216bd4133ba3defada8fb2a3d241c14126efc43097d

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 00:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-28_113c6b4c316197992ab0af39cefe9cc4_elex_mafia_stealc_tofsee.exe
Size 526KB
Sample260629-ap12jsat7j
SHA256 e72c7f8fd64cf32e120d4216bd4133ba3defada8fb2a3d241c14126efc43097d
MD5 113c6b4c316197992ab0af39cefe9cc4
SHA1 846cc498ca5d625e1d733c4de13f03ff639719ac
SHA512 f311af8e851805a82c8800322e7a9d900765e8db05563fddcb174623b25c4c75cc214894fa149293964f4224a1d006fe081030577c5b025b8a2a262dea380285
SSDEEP 6144:zooTAQjKG3wDGAeIc9kphIoDZnexxMae0YLDqDsiOoYfHDwPYGUKKba/TjcUP6+:z6PCrIc9kph5AGiNOo0HzWz
TLSH
T169B4BE385585D2B5D2A383388CEDE68E5C34F111173A74E7A3EC07AD89BDAD09E39607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5312	BCE.tmp

Executes dropped EXE 1 IoCs

pid	Process
5312	BCE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BCE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-28_113c6b4c316197992ab0af39cefe9cc4_elex_mafia_stealc_tofsee.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5312	BCE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1056 wrote to memory of 5312	1056	2026-06-28_113c6b4c316197992ab0af39cefe9cc4_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-28_113c6b4c316197992ab0af39cefe9cc4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-28_113c6b4c316197992ab0af39cefe9cc4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1056
- C:\Users\Admin\AppData\Local\Temp\BCE.tmp
  "C:\Users\Admin\AppData\Local\Temp\BCE.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-28_113c6b4c316197992ab0af39cefe9cc4_elex_mafia_stealc_tofsee.exe 593C08A6A4D6E97FDD14360244F828354E7609E9FA575F25EAE579B7DD54B72BF472B2D345F5B6479BF8A85EC0F9F693F0EDB0E2B3E5B2384D86179E89A157B9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5312

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BCE.tmp

Path C:\Users\Admin\AppData\Local\Temp\BCE.tmp
Size 526KB
SHA256 cabac573246dba1752e45286f4a3d0e99675bb452f07962fd601d473428ffea5
MD5 dcbb02f7404ac48b5a9418905829da01
SHA1 b1e2a9635ab5ce2f44f64ca3ed9748bedb526c9d
SHA512 7c616c45f9e93ce41696efa38f074a09bbb90299c27d1b293b5ec7f2ef4d831ecafb1e781efaf27a0c66624f126ee86bfe20ec59acc415484a1ae4485d16f0f7
SSDEEP 12288:z6PCrIc9kph5RHt3f3uZRn6+OCi8LZT8z:z6QIcOh5h5cnm4La
TLSH
T161B4AE385585D2B1E3A383389CEDE69E4C35B111173A70E7A3EC07AD5ABDAD05E38607
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads