cde8f58ef74f51205b4830794368eef11ddb8ccc57af4b4c1daed0e164ac8253

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 17:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_7d53553bd05b0127e68d3fcc5561c989_elex_mafia_stealc_tofsee.exe
Size 726KB
Sample260702-vtkwcaaw6y
SHA256 cde8f58ef74f51205b4830794368eef11ddb8ccc57af4b4c1daed0e164ac8253
MD5 7d53553bd05b0127e68d3fcc5561c989
SHA1 8b186b6c886d525ec8e086b31168af8276d49d83
SHA512 46a885dd42b8db142835996857893303a6751989f3a4edd211eaf88a79fd0ef3d2663f1bc43e44b8b6e6b7b9364c8bfb12df94211a675a3a88d08ad8762b1ad1
SSDEEP 12288:bO4rfItL8HAmpiX6hoeYK3BQ0LnHkEn75Ux9oUQmvvVrHNORs2WTBklWMtXJthbk:bO4rQtGArb2vLnHTnVUx9oUQmvvVrHNN
TLSH
T1DBF49E2FB3450373C28203B2275B99D6F72EA475137A95D264A8802D1367FB893BB3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5416	96DC.tmp

Executes dropped EXE 1 IoCs

pid	Process
5416	96DC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_7d53553bd05b0127e68d3fcc5561c989_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	96DC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4672 wrote to memory of 5416	4672	2026-07-02_7d53553bd05b0127e68d3fcc5561c989_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-02_7d53553bd05b0127e68d3fcc5561c989_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_7d53553bd05b0127e68d3fcc5561c989_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4672
- C:\Users\Admin\AppData\Local\Temp\96DC.tmp
  "C:\Users\Admin\AppData\Local\Temp\96DC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_7d53553bd05b0127e68d3fcc5561c989_elex_mafia_stealc_tofsee.exe A9A059B08EB8645BAEC8615C374EAC9917E5B2EF65738ED1D5DCA4F5A80A81FC0F644B9C05BD347E779FFA4DC2CDD6C5F895F01CAD116BEACD30A4A67B62D711
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5416

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

96DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\96DC.tmp
Size 726KB
SHA256 d6845b61b13a477aa0c89723b0ea6e5514551c1e8ec0da6acd9f53fc4d4ba0f2
MD5 6c94b4a6b2974711651e78d86caeb2e8
SHA1 1b662d0d0e36671b8c4da1c93f3a8abe10f22055
SHA512 36678a257466ea3afb8ea71cc34b4c512dfef2c62516c92061e2bc3d294167c4262af58e6de3fb83c93ffd1710ff331d59d67008c6011c15336b24b08e58fbeb
SSDEEP 12288:bO4rfItL8HAY0BDx9K2ZSvfIb/Ed75Ux9oUQmvvVrHNORs2WTBklWMtXJthbYDlf:bO4rQtGAxq2ZSvm8dVUx9oUQmvvVrHNN
TLSH
T180F49F2FB3450373C28203B13B5B99D6F72EA579137A95D224A8802D1367EB8937B3D5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download