e9b48e17f729d508f2c0ebcfa52cea0f49d5166733169fe85e5edc843ebaf2d2

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 07:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_84bfa0fd01c8b807a47d80cb316790cf_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260630-hw73fahw21
SHA256 e9b48e17f729d508f2c0ebcfa52cea0f49d5166733169fe85e5edc843ebaf2d2
MD5 84bfa0fd01c8b807a47d80cb316790cf
SHA1 4fe2d59e4140962917bba838c1c1ab676fc658eb
SHA512 1c617fa8d647d78f5347376fb945a747275e0fb07405935ecf78dcb891240246479b4a8c756020bc130a24221728c6c8a7d81ee0c8c16b88fd9b5bb0e4f54b21
SSDEEP 12288:Nb4bZudi79LV+03rSddUah9U1+2/izA0a:Nb4bcdkLjuPUah9U1+2L
TLSH
T1EDA4D0203191C033E1AB02354AE6D7B5553A7DA15F72A8C73B947BAE2EB03E1DA35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4636	5569.tmp

Executes dropped EXE 1 IoCs

pid	Process
4636	5569.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_84bfa0fd01c8b807a47d80cb316790cf_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5569.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 4636	2840	2026-06-29_84bfa0fd01c8b807a47d80cb316790cf_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-06-29_84bfa0fd01c8b807a47d80cb316790cf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_84bfa0fd01c8b807a47d80cb316790cf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\5569.tmp
  "C:\Users\Admin\AppData\Local\Temp\5569.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-29_84bfa0fd01c8b807a47d80cb316790cf_elex_mafia_stealc_tofsee.exe 0E7DDC9C8199AAA017A2B4AAC4FFB3980A80696FF1CB323233E87DC8EA3BE9635FF799DA2C747904CFFEC02FAE9CD77E5B62E21613F63DDC6EE3232E902597B9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5569.tmp

Path C:\Users\Admin\AppData\Local\Temp\5569.tmp
Size 473KB
SHA256 574d8133d568ce9bff406c1d9d2071cfbfedfdf619345e2814c2f435aa00153e
MD5 8f343d52dc90e2a0f33fa5af5f1adc29
SHA1 ddaf8b4fe6b73a91228e2b16273f341d1b3245a2
SHA512 558c7c7b1c3b6804a2035c2d89fc00345089a0215b449583c3eaef961673684ca3e803515676d97f5e1554edb11b1c45e993fd228ffc269d535937fa1d75c66d
SSDEEP 12288:Nb4bZudi79L6ZCHAWoavABrqQh/M4jA0a:Nb4bcdkLmQA7avABt/o
TLSH
T1D8A4E0203581C037E1A711314AE5CBB6563A3DA14F32A8D73BE47BAD6EB06E1DA34357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download