c9878035728f55140193f1513a9c00c2ad6689cfd0d88611f0cd17e43cce3818

Analysis

max time kernel
148s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260630-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260630-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
02/07/2026, 19:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-02_e7fad9c6a474754a51d7d9b28bc2db84_elex_mafia_stealc.exe
Size 435KB
Sample260702-xxtnrsc13w
SHA256 c9878035728f55140193f1513a9c00c2ad6689cfd0d88611f0cd17e43cce3818
MD5 e7fad9c6a474754a51d7d9b28bc2db84
SHA1 5742f06f04a54307ec821a160fa70ccd8831322f
SHA512 9061fab6182e488db21045a9aac6cd913fdf25914209b4a53fb2ece6d5aa28b8353c8d02d754b81d2c62e5f5e1a5debae2c43c4c1a133c2f459f6321d40582aa
SSDEEP 12288:9W4ufepiqKQ1mDKQprFWjIzc6nNPh7g0iJ:9W4ufepiqhmDKSWjaZI
TLSH
T14894E0213586C037E1A316358BF5DBA9593E7DB04B31A8C73BD427AA6E642C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2204	F1DD.tmp

Executes dropped EXE 1 IoCs

pid	Process
2204	F1DD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-02_e7fad9c6a474754a51d7d9b28bc2db84_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F1DD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4440 wrote to memory of 2204	4440	2026-07-02_e7fad9c6a474754a51d7d9b28bc2db84_elex_mafia_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-02_e7fad9c6a474754a51d7d9b28bc2db84_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-02_e7fad9c6a474754a51d7d9b28bc2db84_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4440
- C:\Users\Admin\AppData\Local\Temp\F1DD.tmp
  "C:\Users\Admin\AppData\Local\Temp\F1DD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-02_e7fad9c6a474754a51d7d9b28bc2db84_elex_mafia_stealc.exe 6CEA093746B0F97274948B1FF96171AE8D04A5AA85D0CCA9B491AD0126E5CDD1E01BAD2C4260C74FF567BDD50A6A81A6648AA6320D05B50CE3995F04EFD50590
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2204

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F1DD.tmp

Path C:\Users\Admin\AppData\Local\Temp\F1DD.tmp
Size 435KB
SHA256 c540529fac3f96118ac76c2cdb0379f9403a78bc21fbc0ae1e8d89ff83f7647d
MD5 1add6bc6e85e09a413d1b7f9773fcbee
SHA1 9eb9167612c42cc2e4ab4af4577d4ebe2d52567d
SHA512 042e762920214b19eb08ceacc32e31ed295f3129940b2d8d39c2ef4d8beaa3be6d372ce75dc8aba75e02f79347b660a465d57d40e843f4bb821d372a3200f722
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBY0h+KD0MNyGbUywMXIyIsTvjaFLJDa/ankp3mJK:9W4ufepiqKQ1mjDyywSIyTf6LRasZJ
TLSH
T16494E0217182C036E1E605354BE5CBA9697A7DB14B32A4C73BC42BAE6F742C1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download