39f641f0d5bef58714ff6d52a480dafb7c17c78bc7b3bb10b1764f12167df1e6

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 22:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260630-2qrm2sa16w
SHA256 39f641f0d5bef58714ff6d52a480dafb7c17c78bc7b3bb10b1764f12167df1e6
MD5 4d169c8c5d7a8e36633bc03d42c8cba8
SHA1 9755e89e6221ba8380bdfc66f516cd0438faeab5
SHA512 7488dcfa1e52f7cf9413a7585bf0ef9eceb73766e99687017da236838ca6e5fad93ed6a83e8744550aa79ce726bf30e75f0dda2d53d2c24e5d2e19a114f2b15a
SSDEEP 12288:qO4rfItL8HGgvR+G2jkZUMAa5kz7bWmeEVGL:qO4rQtGGM0G2jkZUXzumeEVGL
TLSH
T15EA4E0367241C133D1A202755FEADB6AA73E75704726A4C33BD442BE1E652D2E33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2844	E402.tmp

Executes dropped EXE 1 IoCs

pid	Process
2844	E402.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E402.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5292 wrote to memory of 2844	5292	2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5292
- C:\Users\Admin\AppData\Local\Temp\E402.tmp
  "C:\Users\Admin\AppData\Local\Temp\E402.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-30_4d169c8c5d7a8e36633bc03d42c8cba8_elex_mafia_stealc_tofsee.exe F8E1330401F35F6C2B86FE4E0E118B46BFAB4D9E4024ED40B35BBEC27C08B7E1E8E93DAC55FF679DD5B1B2815869372DA0A0B40D8634470C5B7A91C1C215EA4A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2844

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E402.tmp

Path C:\Users\Admin\AppData\Local\Temp\E402.tmp
Size 468KB
SHA256 89aa4cfcce27ac09385d775a778c1ec9f1da91b2135cf0930b23340658507158
MD5 06ae7c6bb65d08246259e8b9a7c63524
SHA1 8180fde13daa4906cf4b8261048d2bf8ae6f6b0f
SHA512 e10925470fefa89f1a297d2c0184b585a429327b3ef1f75d3885516e78c5bfdbd69ed7c83c3cce5fdd8323b4304d0cb8e47c4562e87c4100d1f2250a26d47065
SSDEEP 12288:qO4rfItL8HGS61IZnwBKBJiGKc87tf7bWmeEVGL:qO4rQtGGSQIZrKcQumeEVGL
TLSH
T1A9A4E13A7242C133D29302750BE7D7A66A3EB9B4072664C37BD4427E5F616E1D33A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download