56e73f5cd68e3538a7985da32b431fa2fe65b00982de0e3497dcc40824658f94

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260618-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260618-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 05:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-27_8d3df741498dffd885cb4199dbb1502f_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260629-ftvm8adx31
SHA256 56e73f5cd68e3538a7985da32b431fa2fe65b00982de0e3497dcc40824658f94
MD5 8d3df741498dffd885cb4199dbb1502f
SHA1 ad50dd790f93f95411cefc702e34871fc04f2773
SHA512 08c16edee94da35d39e86cedcdaf995902f76b37d5e8754f59d8e28a07cde3c3b658865d0bc792132a7db5969ee9d50c055a91047d08557f6c0545c84a2d30de
SSDEEP 12288:Ci4g+yU+0pAiv+3BfyF/o0aiktwsXZOY32OI8OV+lRYn:Ci4gXn0pD+Rfyu0/ktwyB2yPo
TLSH
T1F794F1203282C037E6A715354BE5CB5666BE79B14B1268CB3BD01B7EAE643D2E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3364	968E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3364	968E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-27_8d3df741498dffd885cb4199dbb1502f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	968E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2712 wrote to memory of 3364	2712	2026-06-27_8d3df741498dffd885cb4199dbb1502f_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-06-27_8d3df741498dffd885cb4199dbb1502f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-27_8d3df741498dffd885cb4199dbb1502f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2712
- C:\Users\Admin\AppData\Local\Temp\968E.tmp
  "C:\Users\Admin\AppData\Local\Temp\968E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-27_8d3df741498dffd885cb4199dbb1502f_elex_mafia_stealc_tofsee.exe 36D8AFCB0750FA0E37160D35D7327C2C72AA5DE58846D9AB991D0C7753F45059A32D140B2C658C87193CAB5E47D998F9E82F7F7C5086756EC7A27C49B7F132F5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

968E.tmp

Path C:\Users\Admin\AppData\Local\Temp\968E.tmp
Size 433KB
SHA256 24b5a83c2d23678cf6cef4c93b822051e46345a2e81a6b84649cead15c5fcb91
MD5 d30184959eab1d42b62ea9d42a105e40
SHA1 ddfba24256433e6caa442e60ade5bdc46631b2ed
SHA512 e878200b1619f9c837f4ac6a181cb8aeb0768c904309517bc6b1a682cd6ae20b7ee03337a78b0d36348c4091acf53d7a201de3ecc540c14ea6ee162cc23c2173
SSDEEP 12288:Ci4g+yU+0pAiv+ZGbrY7WXITZc8nLA82n:Ci4gXn0pD+iY7WX38nLpW
TLSH
T19B94F1203582C033E2A715344FF5C76A697E79A50B22A8CB7BD41BEE6E603D1D63534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download