d5ce1bc86fe783f6211c24c5c21678c917c3391c756bd21687477916b0cd64f8

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_0cf3b161d6db98dc3c2e336446010f9d_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260701-v2v2aacy9t
SHA256 d5ce1bc86fe783f6211c24c5c21678c917c3391c756bd21687477916b0cd64f8
MD5 0cf3b161d6db98dc3c2e336446010f9d
SHA1 5d9f719ca43228aee21dd36b6ef9f4159e925fff
SHA512 176eaa4069b1430d6d3756c4e434b312b8f9e2e31fb0fb4026e0e3dfe1fbae53ba064baddb310fa3e3cdb5b0d746c021b39eaffcf3e1d0ff272b1b663a4d4d88
SSDEEP 12288:Z594+AcL4tBekiuKzErO57R8Z4hdzHNBSV7LIqMUuhriqtl:BL4tBekiuVrI7zhtNBaIq3u5
TLSH
T11494F1353582C037E5A311388BF18BAA597E39B64B2AA4C77BD01B7D5EA42D2C734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1956	7FE9.tmp

Executes dropped EXE 1 IoCs

pid	Process
1956	7FE9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_0cf3b161d6db98dc3c2e336446010f9d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	7FE9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4256 wrote to memory of 1956	4256	2026-07-01_0cf3b161d6db98dc3c2e336446010f9d_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-01_0cf3b161d6db98dc3c2e336446010f9d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_0cf3b161d6db98dc3c2e336446010f9d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4256
- C:\Users\Admin\AppData\Local\Temp\7FE9.tmp
  "C:\Users\Admin\AppData\Local\Temp\7FE9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-01_0cf3b161d6db98dc3c2e336446010f9d_elex_mafia_stealc_tofsee.exe 7E98C0B516083CA26793412673ED488B94D8C23BD9892E513786E5C7E59023C8636699D4C7A747AA9209A6EEC95E214A1747DC1133831E4C5A8506093190B54E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1956

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

7FE9.tmp

Path C:\Users\Admin\AppData\Local\Temp\7FE9.tmp
Size 428KB
SHA256 2729640410c3d4696c1a848d865fafb5361d25dd39aa80de810c3aadde41cc58
MD5 82ee907a59cb957f99870f4a7b936a41
SHA1 6c6fc676b8ce7756dc8e3dab7bb40a6d51b48279
SHA512 50e0177109b26d4537a7215c9239c7b2a14758990030d4c44a0b0fb726f46672519fd6308a1dc37778b49f2c5ec371426e1e3106f49f5554c5b3ae77868f606f
SSDEEP 12288:Z594+AcL4tBekiuKzErA0Fds9zxw9UxLUmTgQIjTl:BL4tBekiuVrA0IEGlHIf
TLSH
T15A94F1203582C033D2A705354FE1CBAA5A7E78B94B2AA4C77BC4176E6FA42D1DB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download