c232f2dce0a07d860bf732be047e67d7e37584ede715176ac8d7f2f52a7ac69b

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
30/06/2026, 11:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-29_2bc976a5c04bbf0531c985b0081e0320_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260630-npjddsdy51
SHA256 c232f2dce0a07d860bf732be047e67d7e37584ede715176ac8d7f2f52a7ac69b
MD5 2bc976a5c04bbf0531c985b0081e0320
SHA1 d00223a85e7970221e2902cbc7864b2ba3d54bcd
SHA512 6f489a0a9ad5f5dc6bcdb3b55c8abfc1dd061321f3e897dc26676f87979cf7693c1db24027d2cea237f6225eebc84ffa10a3c452d2b7c34aecc605e7142c6ef3
SSDEEP 12288:3O4rfItL8HPx83MQWJPUTvhlL1M5B1RAPtEdsXSC17rKxUYXhW:3O4rQtGPx83MQvZDMNR4t9p13KxUYXhW
TLSH
T1C4B4F12A7781C233D2D202750BD6DAE6A63EB9711336A4C33794417D1F61AE1E37A387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5804	7A7A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5804	7A7A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-29_2bc976a5c04bbf0531c985b0081e0320_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7A7A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5816 wrote to memory of 5804	5816	2026-06-29_2bc976a5c04bbf0531c985b0081e0320_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-06-29_2bc976a5c04bbf0531c985b0081e0320_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-29_2bc976a5c04bbf0531c985b0081e0320_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5816
- C:\Users\Admin\AppData\Local\Temp\7A7A.tmp
  "C:\Users\Admin\AppData\Local\Temp\7A7A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-29_2bc976a5c04bbf0531c985b0081e0320_elex_mafia_stealc_tofsee.exe 8C8CD545BDCA9C8BEDA3C1D0CAD9559DFDA2B985CE66B67E225479B3D59C7653F17EA68FC9EDB8F935B06C9202682528D30943289070371031D53507823ACA08
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5804

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7A7A.tmp

Path C:\Users\Admin\AppData\Local\Temp\7A7A.tmp
Size 486KB
SHA256 788b02d3f292bb7ab6af096cf5e9f92565ad1bd106de3bb8d5a13afcb58e41e8
MD5 ec9b0c8060fa0c4100ea626e95672c36
SHA1 be14d8415187a5922e52d91f49e003dfd1ffab1d
SHA512 cd95f42c3cdc540db120b8f420b815bee1d0d251880eadfed71353c28e8723387c8f3785d0f02f1a4d109c12ad0fb4b1358c1656fc870486e9f15b0a1b6b3789
SSDEEP 12288:3O4rfItL8HPDOX+1/XxL3uG32+q7rKxUYXhW:3O4rQtGPDlxl2r3KxUYXhW
TLSH
T16EB4F12AB7818233D29301751BDBD796B63E78B5132694C33BD4427D1FA1AE1D33A386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download