960f3cfc041155aa9fbcdf7ee07dd8e27032383a83ae9206414e0d924aa0550b

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260629-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260629-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
04/07/2026, 06:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-04_cb9456d53ec6e7bbee353d410be346e6_elex_mafia_stealc_tofsee.exe
Size 443KB
Sample260704-hbbthaf15r
SHA256 960f3cfc041155aa9fbcdf7ee07dd8e27032383a83ae9206414e0d924aa0550b
MD5 cb9456d53ec6e7bbee353d410be346e6
SHA1 b4c9fcffda8d48a2d06afe5280bc02dd7286f49e
SHA512 fc0cac9a092cd81759e149b95a7c243905e8d91f86aa8d3dc4c604c07de9dac78c97cc7e0ac122ea1ecfc7c8eec3f624c05f5f50766ede9f8072c0903e76ac9d
SSDEEP 12288:Wq4w/ekieZgU6/Fufdl6ryv8batjb7kxGH0B6lMa:Wq4w/ekieH6Qfdgyv8mR7v0B6P
TLSH
T119A4DF213582C037E1A7063586E4DAAA1A3A7CB15F71A4C73BC437AE9E746D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5096	25.tmp

Executes dropped EXE 1 IoCs

pid	Process
5096	25.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-04_cb9456d53ec6e7bbee353d410be346e6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	25.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5924 wrote to memory of 5096	5924	2026-07-04_cb9456d53ec6e7bbee353d410be346e6_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-04_cb9456d53ec6e7bbee353d410be346e6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-04_cb9456d53ec6e7bbee353d410be346e6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5924
- C:\Users\Admin\AppData\Local\Temp\25.tmp
  "C:\Users\Admin\AppData\Local\Temp\25.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-04_cb9456d53ec6e7bbee353d410be346e6_elex_mafia_stealc_tofsee.exe 8BA694E86169D188CC230DF271AC319893F0474689D7520905B055411A1161F61FC168DF0F1568B538C6B88B47D6FA4DDE6E04F43095F4216E5504CAAC81DBBC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5096

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

25.tmp

Path C:\Users\Admin\AppData\Local\Temp\25.tmp
Size 443KB
SHA256 84e104b42bf4b1705f853e429bfb43ba84880d0baef7ea4ef526b064be69ab5d
MD5 203997b5da124937b7a30fcbb1ef307e
SHA1 373c0e91f839943dd7c5eb812282422af0c8a458
SHA512 d60c0654c100aab398fce64c12c154b7074ada1bca4368c5451b74b31f9d5ab79e246df4a32215dd018f6c90d887d6a30b948f2412e2282ad1ae59d27c759a8b
SSDEEP 12288:Wq4w/ekieZgU666zHgZoI8qlJdOGNFyzS++lMa:Wq4w/ekieH6zzHgioJ/FyzS++P
TLSH
T1F5A4D0217586C036E2A706354BE5CAF9153A7DA40F71A4C73BD43BAE6EB42D1DA3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download