8e19c8cac1cd108ead4e466aa689c0d31116a447088bf82866f677caae4ea740

Analysis

max time kernel
148s
max time network
122s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 04:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_b658eae788c4da18dcd618e4e1012837_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260630-e54jtse15k
SHA256 8e19c8cac1cd108ead4e466aa689c0d31116a447088bf82866f677caae4ea740
MD5 b658eae788c4da18dcd618e4e1012837
SHA1 c86cf78d441b802fe88f9e08f33ca452be3d6481
SHA512 820ecf33bcc7bedae9f1e24c0738edac477f5e4296ce493175126fd04429bd349fc2540d03e44a85769d70b5568d191c044f78c923ebb7df25fd259f5cfa70a4
SSDEEP 12288:Nb4bZudi79LMwBunkicj74qTGLID54CKjuA0a:Nb4bcdkLzBwUAYGLI+pJ
TLSH
T124A4F1243181C033E69706384AE5C7B5A97E3DA15F3168CB3B903BAE6EB02E1D675357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1320	B7B2.tmp

Executes dropped EXE 1 IoCs

pid	Process
1320	B7B2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_b658eae788c4da18dcd618e4e1012837_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B7B2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5196 wrote to memory of 1320	5196	2026-06-29_b658eae788c4da18dcd618e4e1012837_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-29_b658eae788c4da18dcd618e4e1012837_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_b658eae788c4da18dcd618e4e1012837_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5196
- C:\Users\Admin\AppData\Local\Temp\B7B2.tmp
  "C:\Users\Admin\AppData\Local\Temp\B7B2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-29_b658eae788c4da18dcd618e4e1012837_elex_mafia_stealc_tofsee.exe 493BFCF4091CF47CF25CC1FE49A0657A5ED267C934C81D75792CE3D67349AD31EE3BEB48C35E062AFF259F7548FD17B35B6AC3BC13E349817D3D2F69AE9F6605
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1320

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B7B2.tmp

Path C:\Users\Admin\AppData\Local\Temp\B7B2.tmp
Size 473KB
SHA256 a1d288230739ec0c6c6d8e62172f2917133cbb6c89f019eb5c4743eaf484e897
MD5 91aa9c29a81369a40811fd554f5e15ab
SHA1 7b52266ce79676664c161d77fb10c2934e82b678
SHA512 7151d36e839d85b30260a33c5b9dae4de337b9b435af666e51cabd3ad8ec1add363abd00a5e8e2d41252e47545d12d87cf29d39ce0e92c72b47939d0468250c3
SSDEEP 12288:Nb4bZudi79L9w9k46R3N/0KWvFSssirJA0a:Nb4bcdkL9wq7RYFTsN
TLSH
T1B2A4E1213581C037E29716394BEAC7A6597A3CA15F3568CB3BD43BAD2EB02D1E634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download