ff04af815e1ea85e37cbebbed15ab797ed942ed96e29a6773239c9f1ac3b61ac

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
01/07/2026, 19:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-01_5cd6007b0aa282866976b50efec01671_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260701-x23ggae12z
SHA256 ff04af815e1ea85e37cbebbed15ab797ed942ed96e29a6773239c9f1ac3b61ac
MD5 5cd6007b0aa282866976b50efec01671
SHA1 8a8d55e2d069e6da1bf84e3dc8ec618740b27502
SHA512 2a6dc1dcc964d92754963bbb3cf0c06113321cc221ecf73ec2d14affd19dfba83ba40d106d2375a15173e34725d0ea4e7ef1a4ffb3279a0d46bdce3f243c263d
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6zmQhnRPlQdaV0u0u6pmI5nkHdfioZ:Wq4w/ekieZgU6PnRPlQdaau0u6p15s
TLSH
T14094E031358AC037E2A715354AE4CAB9697A7D754B36A8C73BD427AE2E342C1DB30347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5684	263B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5684	263B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-01_5cd6007b0aa282866976b50efec01671_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	263B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3772 wrote to memory of 5684	3772	2026-07-01_5cd6007b0aa282866976b50efec01671_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-01_5cd6007b0aa282866976b50efec01671_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-01_5cd6007b0aa282866976b50efec01671_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3772
- C:\Users\Admin\AppData\Local\Temp\263B.tmp
  "C:\Users\Admin\AppData\Local\Temp\263B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-01_5cd6007b0aa282866976b50efec01671_elex_mafia_stealc_tofsee.exe CABF681F8EA94EAA6DD03916EA6AA45FF34D308FFCFACD91D91D82A287D38970850950E667836A4DA6DA112472A51B22DF9FAB5E29903D529475F68BAB456691
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5684

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

263B.tmp

Path C:\Users\Admin\AppData\Local\Temp\263B.tmp
Size 414KB
SHA256 6b4444ed2c86d0bd3ef66c081bc9d7b0d78f8e1262f5fb68fc8bc73f5008bd0a
MD5 3787340fc840df5fd38761d3ed3673df
SHA1 acd26d94a1c2203ddfa054ba55f38fe918668fc0
SHA512 a64768be2b271f725dda913ce1c718e5d110c246044bfb0975c218a9619d1fff87ed97ccd9817a963188d4a15c234aad0d1023dab95a40146ca5624854449b71
SSDEEP 12288:Wq4w/ekieZgU6yNMU+Yd1r6KLpx8uSF19Ocy:Wq4w/ekieH6yNMUVd1rb38tr7y
TLSH
T19B94E0317586C037E1E706354AE5CA6A293ABD750B31A4C73BD42BAE5E742D1EB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download