f39482a2a205525e29997e64fa0fd47ffb7595f5a5925f4a99c9734608a54ed7

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_5d9fba9b07bffb75a40eaef6e28ccedf_elex_mafia_stealc.exe
Size 435KB
Sample260702-v5f2jaay7t
SHA256 f39482a2a205525e29997e64fa0fd47ffb7595f5a5925f4a99c9734608a54ed7
MD5 5d9fba9b07bffb75a40eaef6e28ccedf
SHA1 fcbdd82bc886bacd14bca54facb53c3f52a9e54e
SHA512 3552554e0deccfad085b33291d7c785acdd85a3f8d8e6f4fe220c1411d611ba484f3e371beca6798a57b162944d9e804af64d8e41a9c8f32c80a856ada2f99de
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBYOd3S6R/fmfrDpbZt85uSNhAr/JK:9W4ufepiqKQ1mxAW/MrDFf8IS/8/J
TLSH
T1FB94E0313282C037E1E706344BE5CBA959797DA01B75A8C73BC42BAE6E742D1DA3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5380	D85A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5380	D85A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_5d9fba9b07bffb75a40eaef6e28ccedf_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D85A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 756 wrote to memory of 5380	756	2026-07-02_5d9fba9b07bffb75a40eaef6e28ccedf_elex_mafia_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_5d9fba9b07bffb75a40eaef6e28ccedf_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_5d9fba9b07bffb75a40eaef6e28ccedf_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:756
- C:\Users\Admin\AppData\Local\Temp\D85A.tmp
  "C:\Users\Admin\AppData\Local\Temp\D85A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_5d9fba9b07bffb75a40eaef6e28ccedf_elex_mafia_stealc.exe 535E713A99CA540F518E662AE2BCE379FD8B72C27DAC0E8F46D5EE9C7889CBB31D766D23A81A7B59B58A5DCC94F3CE7A8BE9589398191F1F65F2DD28BFFBD58C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5380

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D85A.tmp

Path C:\Users\Admin\AppData\Local\Temp\D85A.tmp
Size 435KB
SHA256 ea231b248104b91144fc2f7a44fe07d577d3a8c1702064ef9830ac16a9613ae5
MD5 cb88fcf9cecb3267f5af3361e02a1999
SHA1 46e0095df6653fadcf7e0ba3a382cc4e1e005780
SHA512 2bb5b38727b6b57b21db55e0d07f99a089f574115e0339e6e649dd1c3a9bd24ddaff7608f06471076cffa15f0310c7bf64900d5b5b220af8dc95cf09ee7bc52e
SSDEEP 12288:9W4ufepiqKQ1mBrmxlUOYSkBKh8CDgIzDJ:9W4ufepiqhmYMzs8CPD
TLSH
T17E94E1313546C03BE2E706354AE5CB7959797DA04B32A8C73BD42BAE6E642C1E73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download