5e011056acdeb853c04e85d91d0a31afeeb56dd2e9b330cb6aa95d69a40e2140

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 14:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_6d95155666867f4cc5e8387079042644_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260702-scl1zagw3s
SHA256 5e011056acdeb853c04e85d91d0a31afeeb56dd2e9b330cb6aa95d69a40e2140
MD5 6d95155666867f4cc5e8387079042644
SHA1 8b22fd25414d6eacff7f78f589e01554998e05cd
SHA512 a56d6cdafc9da7d57dcdd1f4e81920294737873123cce51e7858de8931e871e56f74442698e4e12b9e9f1bbf17c0032b6ab5b868d7c4c90357b0f03d45f241b5
SSDEEP 12288:bO4rfItL8HAU653l4medf7BAdHO9rJl2x75UO:bO4rQtGAUQV4R7BAgllsVUO
TLSH
T151A4F12A73418133D2D302715BDADAA6BB3E79710326A4C33BD4067D1F65AE1D33A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3388	8E41.tmp

Executes dropped EXE 1 IoCs

pid	Process
3388	8E41.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_6d95155666867f4cc5e8387079042644_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8E41.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3700 wrote to memory of 3388	3700	2026-07-02_6d95155666867f4cc5e8387079042644_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_6d95155666867f4cc5e8387079042644_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_6d95155666867f4cc5e8387079042644_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3700
- C:\Users\Admin\AppData\Local\Temp\8E41.tmp
  "C:\Users\Admin\AppData\Local\Temp\8E41.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_6d95155666867f4cc5e8387079042644_elex_mafia_stealc_tofsee.exe C7FD6F0FE432B1390272D02ABE063CD5917E232EDCEC4D3F11786BF7CF2CEE855A8B559496D89C9DE6146CD656D104A34E81F5680FBAB467A4A5E7D4316CE361
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3388

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8E41.tmp

Path C:\Users\Admin\AppData\Local\Temp\8E41.tmp
Size 479KB
SHA256 878c8aebc43d1b61b95deea5e98db3aebbfda245c8dcb37945289212570c2682
MD5 c00254f96036c1055eefada7e5c7d5a3
SHA1 e7464e159e1198302a597b05fe3e5533455c8708
SHA512 035c4cbe3b1f5b75fedf6c63a2230674db84687232741565c656522b75713a1c43e556d81d76f6392ebec0861d15f9f3d4f560dae2da5af5ff40b7e83eb37246
SSDEEP 6144:b9EyS4oMxIkjxcWqHtg88HARRjSOv8DcUOlb/smYOds9C8ovndFW/HlY0bvSnHan:bO4rfItL8HAruD1OWL34niNS675UO
TLSH
T115A4F12A7681C133E29302755BD6E7AAA63E39700726A0C73BD8427D1F657E1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download