926197e20a465e11b232dc19ada011a7b16b8e59c9807991f2e2e18c6851a109

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 03:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_c5ed8e4185303afc230b76b59fa93c00_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260630-ebvd3aev7q
SHA256 926197e20a465e11b232dc19ada011a7b16b8e59c9807991f2e2e18c6851a109
MD5 c5ed8e4185303afc230b76b59fa93c00
SHA1 94d0516c948693e9c52fa027a4dbaad4caa9c9c7
SHA512 bcec8504d7e72010cb4a505f8b470af7ead7c98cf6f376d9d7a7695dd542c42012b32a7e0f59128f50d9353a9065cb05d0f6ec4d797a142726d4f3d82ec56ad9
SSDEEP 12288:aO4rfItL8HRChYdoInROuTdi7K9wlsDpVFd:aO4rQtGRCmdoInMq8+9wlsDpVFd
TLSH
T138A4F12A76418233E29312710BD6CBEAB63E79710726A4C337D4077D2F61AE1D376386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2868	7CEB.tmp

Executes dropped EXE 1 IoCs

pid	Process
2868	7CEB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_c5ed8e4185303afc230b76b59fa93c00_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7CEB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6120 wrote to memory of 2868	6120	2026-06-29_c5ed8e4185303afc230b76b59fa93c00_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-29_c5ed8e4185303afc230b76b59fa93c00_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_c5ed8e4185303afc230b76b59fa93c00_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6120
- C:\Users\Admin\AppData\Local\Temp\7CEB.tmp
  "C:\Users\Admin\AppData\Local\Temp\7CEB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-29_c5ed8e4185303afc230b76b59fa93c00_elex_mafia_stealc_tofsee.exe F5641A089652BE216BF0B4EE0D456FEAD63D5408D8A572770BB5014FAD481FC2C2CF1D64830BEBC2888A50956EE21801B3CFCE2D74AAB41953DA24D5B58B3523
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7CEB.tmp

Path C:\Users\Admin\AppData\Local\Temp\7CEB.tmp
Size 476KB
SHA256 75cbbfefa07a920cbb61227c1540a09017da9b89e7aa584d68aef0df04e7a688
MD5 1669e3876ae9d084572bb3074c2e9aa6
SHA1 aab86b670b26749a9cf7ee8eada6abde537df197
SHA512 cdfe5ff78e8ce76c86072559342b693bab4c270f297661b0b0c3e7387fe0ba872b3b7ee78fa7064e3377a2f85f44fe60b1c49fd35930ddd5e9e07c9e4eb5df43
SSDEEP 12288:aO4rfItL8HR1iToB1tsWcg+1vyF2XC7q1I7K9wlsDpVFd:aO4rQtGR14oB1tshvJXy+9wlsDpVFd
TLSH
T101A4F12A7681C133D28301751BE6CBAAA73E75B4172694C77BD4023E1F61AE1D37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download