c223d60f6d60f63eb54df57a3e39afeabd9ddafb22800dfd6c7c92123bb49e45

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_e456ae7823e80e1054fadaeeda1f4ceb_elex_mafia_stealc.exe
Size 435KB
Sample260630-cmdvcacv9x
SHA256 c223d60f6d60f63eb54df57a3e39afeabd9ddafb22800dfd6c7c92123bb49e45
MD5 e456ae7823e80e1054fadaeeda1f4ceb
SHA1 d208295c452ba2d6b76392f64109ee5b393fe286
SHA512 b515fd47d7cf03868f30f60b726603cb2a8892cf237ffe8a7e068df16c3f646b46670f3ab05d15c94b9038392f0f1c1bd25fc11fa6cb3d1f5dbdcda3b9b319a6
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBYbJwPpvGn0CjVVEmWcadKwh8CMrVGUrJK:9W4ufepiqKQ1m4Wpk00VE5Ph3uVGUrJ
TLSH
T1F294E0247186C03BE1A605384BF1DBAA59397DB44B32A4C73BD42BAE6E742D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6040	5F32.tmp

Executes dropped EXE 1 IoCs

pid	Process
6040	5F32.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_e456ae7823e80e1054fadaeeda1f4ceb_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F32.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2540 wrote to memory of 6040	2540	2026-06-29_e456ae7823e80e1054fadaeeda1f4ceb_elex_mafia_stealc.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-29_e456ae7823e80e1054fadaeeda1f4ceb_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_e456ae7823e80e1054fadaeeda1f4ceb_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2540
- C:\Users\Admin\AppData\Local\Temp\5F32.tmp
  "C:\Users\Admin\AppData\Local\Temp\5F32.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-29_e456ae7823e80e1054fadaeeda1f4ceb_elex_mafia_stealc.exe D960D58B5989FEF4DF596FFC4AC44065D060F6B9641CDC5BE267399DCC550C49991FCFA3C4AB25A4C196A2B1721AE9719E596884CF6B284B5363209EB6CB415D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6040

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F32.tmp

Path C:\Users\Admin\AppData\Local\Temp\5F32.tmp
Size 435KB
SHA256 3d3578b100fc43eccb6dce6c4bea9efce70826bf500b39103c2f6b429abe76f1
MD5 76d10075c1947ce4fae3162ab65cd515
SHA1 e5f34f407042632907be605782bb9ead9002b453
SHA512 a74f71bd87bf0085c4e418771f9b0b6793a1985f23ea6b2c53b1759d86fa3be5093f06b950e79eb8d03db841316c53dfe52ef467e761471ff07b49fb63576000
SSDEEP 12288:9W4ufepiqKQ1m9ouBukas+xnyxSPDYtJ:9W4ufepiqhm9ouBcJnyxSG
TLSH
T14494E0207282C03BE1E705348AE4DBA9696E7DA54B35A4C73BC427AE9F712D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download