9a60d2b383e12421205b0ae4dfbb356f64a6927ed3de20fc8a35f06c242ac6f8

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260617-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260617-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 04:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260629-e4bseset3l
SHA256 9a60d2b383e12421205b0ae4dfbb356f64a6927ed3de20fc8a35f06c242ac6f8
MD5 a133525f0730a2b9da67f50412ff9795
SHA1 05fa4d193a28f71f402c06d8150eb8b707af7d3a
SHA512 0d230311372bb233e7c42299f2292010f8efa410d46997290a5e92233893d2b62d6dc467ba1abf48c17ef89703d69692f2ab3d202adf8c3599904e209a729680
SSDEEP 12288:bO4rfItL8HAmcj+h0E/GvjjnnoWg6MpD75UO:bO4rQtGAdS3/OjjnoWg6MpVUO
TLSH
T140A4F12A76818133D29302311FE6D7A9BB3E75B10726A8C73794467D1F65AE1C33A387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3480	B66A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3480	B66A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B66A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 456 wrote to memory of 3480	456	2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:456
- C:\Users\Admin\AppData\Local\Temp\B66A.tmp
  "C:\Users\Admin\AppData\Local\Temp\B66A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-27_a133525f0730a2b9da67f50412ff9795_elex_mafia_stealc_tofsee.exe 37D7542E06CB9C81E0500DC79976BD367D92E5B30DE23C2715E0A758400339A5EA1E8DB10079422039235C6A69E8B04C8E82F26B6F6C85D69D3D3254BEC52EFD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B66A.tmp

Path C:\Users\Admin\AppData\Local\Temp\B66A.tmp
Size 479KB
SHA256 93ae3725a92d73d6a05683cdfa93d309b97010e7d88179e484b3a50823db8a8c
MD5 c26496e138950dd31e8bf91e1bb0d294
SHA1 71e7a9e0f8051da5046d7682ce7575f1c3603ae7
SHA512 fdbb9fd7f560b14247fd065ecd11f67c8a51aba99cda704a691d0f733d7cb26a1913ab7f30b1cd227fd988ae1dc003169b5e7b48726c20c9694c29aa505dfdd7
SSDEEP 12288:bO4rfItL8HAp5LIlAoRD5070Z3l24G74L9F375UO:bO4rQtGApGlA7q3gb4L9hVUO
TLSH
T15BA4F1267640C133D28302711BD6DBAA663E79B1177AA4C33BE8427E1F616E1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download