e0368a1d589c9f6ee39adcda197908055ff8ac7baa97e45d9588a2187cd278be

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/07/2026, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-03_4ab5a454a73f62f9f965cb1327674704_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260703-zz4mvsgt2x
SHA256 e0368a1d589c9f6ee39adcda197908055ff8ac7baa97e45d9588a2187cd278be
MD5 4ab5a454a73f62f9f965cb1327674704
SHA1 9265e09626edf8010dd58f5c94ec7aec24d4f4a6
SHA512 aaf01ca74c2e4125a8be84545923e5594f3dffb73d78838d6be5005755c264d8417d5df56b2c0dec63c7ba55b77ea2dc3334a5173e3bda677645e5ebc1087869
SSDEEP 12288:Z594+AcL4tBekiuKzErAm2OfTX3xEq2GT9TT/25Zl:BL4tBekiuVr5rX3aq2GxTO5Z
TLSH
T1CF94F0213482C033E29719354FF5C76A257E79B64B26A8C73BD42BBD2E606D2D634387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5944	CC44.tmp

Executes dropped EXE 1 IoCs

pid	Process
5944	CC44.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-03_4ab5a454a73f62f9f965cb1327674704_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CC44.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2868 wrote to memory of 5944	2868	2026-07-03_4ab5a454a73f62f9f965cb1327674704_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-03_4ab5a454a73f62f9f965cb1327674704_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-03_4ab5a454a73f62f9f965cb1327674704_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2868
- C:\Users\Admin\AppData\Local\Temp\CC44.tmp
  "C:\Users\Admin\AppData\Local\Temp\CC44.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-03_4ab5a454a73f62f9f965cb1327674704_elex_mafia_stealc_tofsee.exe 338F7B36D90C16B70E0100DFA08BC2E05AF76766E5B4D0E69CC0C8797198AC68C220EF155957589C03573A58A029FF93BD2F792EAF0E63D1E81FDD4B1A2F1CDB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5944

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CC44.tmp

Path C:\Users\Admin\AppData\Local\Temp\CC44.tmp
Size 428KB
SHA256 adf6eaf83f566cdd852c18061e8d3ce9dbd57ef42f21bb7af33c2ff1041cf269
MD5 188378437deeee7073df7b8106f39b02
SHA1 f033df37275f620ab8bdb8ca20df84aaf1e451be
SHA512 4fdc7baa79367d18620b29856b35039a210f951d381982c2c9e458b94e95c48ee34ebe93361609ed30491a1318ce6c233eda39b290fcd77cb79342be59ff59b2
SSDEEP 12288:Z594+AcL4tBekiuKzEroanuAUgEHC1p1CZpvMl:BL4tBekiuVr7dUxC1p2E
TLSH
T1C194E0353682C037D2AB12384FF1D766567E79A20B2668C73BD417BE1F642D2E63434A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download