9ef4d6132e40e5e58a2335de10da7d6d4b2be4b5b10f5664232b876669e044d8

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
29/06/2026, 14:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-26_90c57a85bac77725a6fdf44f6ea8c6c8_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260629-rbxweagy2p
SHA256 9ef4d6132e40e5e58a2335de10da7d6d4b2be4b5b10f5664232b876669e044d8
MD5 90c57a85bac77725a6fdf44f6ea8c6c8
SHA1 5bad9d4e45f20353c31655014aa4fb29d9e1a8fa
SHA512 a0ea7febd32438f2e6c0cca6315476ef10411030c21ada346f4688e34f31b1d676df0c50aed7a8d4db9180f3acaa5be53a0e95175b21b023b351f2ff623c6eaf
SSDEEP 12288:4j4pdePiuVZPLbN5fb1r5Mi5nwC66KkhY7pI+8:4j4pdePiufLb7x9Mi5wVdGX
TLSH
T1BD94E0217182C036E2A706344AE5CB79596A7DB14B36A4C77BC03BAE9F742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6224	B1A7.tmp

Executes dropped EXE 1 IoCs

pid	Process
6224	B1A7.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-26_90c57a85bac77725a6fdf44f6ea8c6c8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B1A7.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5852 wrote to memory of 6224	5852	2026-06-26_90c57a85bac77725a6fdf44f6ea8c6c8_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-26_90c57a85bac77725a6fdf44f6ea8c6c8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-26_90c57a85bac77725a6fdf44f6ea8c6c8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5852
- C:\Users\Admin\AppData\Local\Temp\B1A7.tmp
  "C:\Users\Admin\AppData\Local\Temp\B1A7.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-26_90c57a85bac77725a6fdf44f6ea8c6c8_elex_mafia_stealc_tofsee.exe 84F1053AA37E3FB77D8C21C0472F3D5ED14BCF7A0A1EC5D413DF0D130BAB2D931416B085128064BB31B6F032D33B78F970C57319E157FB7F01ABDB29D1F6AF69
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6224

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B1A7.tmp

Path C:\Users\Admin\AppData\Local\Temp\B1A7.tmp
Size 435KB
SHA256 972e9d918e522b6f37aed5e4e3b717cfe76d594f947553fcebca0d46cb685a00
MD5 09f537d466d4e39d4ff3cba2cc1fa08b
SHA1 861d6a9dffc4deb7d6420b071556b97fc125a111
SHA512 f016bf5d49f34c38c84273a9077972039ab367fcd23d7fefbe23c6bbc54fc8b62e40784500f9e6b36d2ea1b29b92301907f3b2a56ac1f32731508b50704ceeb8
SSDEEP 12288:4j4pdePiuVZPLqduDpKSMEpwXgHSGA+8:4j4pdePiufLqdUPbTAX
TLSH
T18694E1213582C036E2A706344BF5DBA9697A7DB04B32A4C737D42BAA5F701D1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download