d584fe55d04d19a28459a621ff6113b46558c243fbd31bf795f977e93c895cdc

Analysis

max time kernel
148s
max time network
118s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_6a31dc525cd3b42805db7aee75e1121a_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260701-vlaemsay6m
SHA256 d584fe55d04d19a28459a621ff6113b46558c243fbd31bf795f977e93c895cdc
MD5 6a31dc525cd3b42805db7aee75e1121a
SHA1 1b2c7df9925561b722ad350f420c17abf652bff8
SHA512 1359bf22574b59dcabe58236acf22f8e55b7e06c6f53c8f96c24e767ed2a98301dc4ff68a9f60cba43528c69d362e82ad906fa82cc93477fa1af1609ef638b22
SSDEEP 12288:aO4rfItL8HRbskxfyl7v2eA+E83J8PxXgyY2hxt2o7K9wlsDpVFd:aO4rQtGRbzi+c3J8PxwyY24o+9wlsDpN
TLSH
T124A4F12A7281C133E29302750BE6DBEA6A3E78B51725A4C337D4023E2F516E1D77A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1248	1D42.tmp

Executes dropped EXE 1 IoCs

pid	Process
1248	1D42.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_6a31dc525cd3b42805db7aee75e1121a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1D42.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4456 wrote to memory of 1248	4456	2026-07-01_6a31dc525cd3b42805db7aee75e1121a_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-01_6a31dc525cd3b42805db7aee75e1121a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_6a31dc525cd3b42805db7aee75e1121a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4456
- C:\Users\Admin\AppData\Local\Temp\1D42.tmp
  "C:\Users\Admin\AppData\Local\Temp\1D42.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-01_6a31dc525cd3b42805db7aee75e1121a_elex_mafia_stealc_tofsee.exe 1C7C0C38737193BEFFDBF139F371923773A5554838F8D9AF6470B746EFF351E082D2FE4BD42F6F4F6760CCE8269343D453C402B13CC9F35F864AC7DAABE46E83
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1D42.tmp

Path C:\Users\Admin\AppData\Local\Temp\1D42.tmp
Size 476KB
SHA256 620c2a2944ddbee268dd448ffda6cf999a18795e94eb5e4d512c42466d9ed72a
MD5 c3657ba0f295dc114377406b808dfd44
SHA1 dfd07025b84bf871439e58f77bb97c0a7c3ed8b7
SHA512 79ba59fe2b2409a4082e18f535edc4b5cfcea4f1634372475cf98b9da1d0eb66af4a026b89d6cab5bce1355bf62c21d88dccabebf19ee50edd1456c885cf5f00
SSDEEP 12288:aO4rfItL8HRO9oq3sdPPsdEO/sowmK7K9wlsDpVFd:aO4rQtGRO9D3sdcP/f2+9wlsDpVFd
TLSH
T192A4E03A7681C233D29302355BE6DBA9663E3871072694C337D8023D2F656E1D77A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download