d404e5c91d022bd0d46a86e9f9279ffa24258c50e7f61c73e50cd79d4320d047

Analysis

max time kernel
150s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 03:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_6cd5395bb44bdaf37c5210c49d9619fe_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260707-dn4ylady2m
SHA256 d404e5c91d022bd0d46a86e9f9279ffa24258c50e7f61c73e50cd79d4320d047
MD5 6cd5395bb44bdaf37c5210c49d9619fe
SHA1 034fb885e1fe06c3ab1e10fb27b3bddbaea07512
SHA512 b88d02cdf30328632a6e3b897a1a47234d2db3d34b8e4cc958f93a8be0b81d2a8169b4af4f6fc533f2c845ca3452cdea7e0e5acf4f15ff16ccd88dfd3888deb5
SSDEEP 12288:Nb4bZudi79Lrej2JwJ/hMG8ngoYpWSA0a:Nb4bcdkLqKJwxh9uJ
TLSH
T18EA4E1247582C037D2A706380AE6CBB5663E3DA15F2164C73BD43BAD2EB06E1D63535B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5248	EDF5.tmp

Executes dropped EXE 1 IoCs

pid	Process
5248	EDF5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_6cd5395bb44bdaf37c5210c49d9619fe_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EDF5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 5248	1844	2026-07-06_6cd5395bb44bdaf37c5210c49d9619fe_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_6cd5395bb44bdaf37c5210c49d9619fe_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_6cd5395bb44bdaf37c5210c49d9619fe_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Users\Admin\AppData\Local\Temp\EDF5.tmp
  "C:\Users\Admin\AppData\Local\Temp\EDF5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-06_6cd5395bb44bdaf37c5210c49d9619fe_elex_mafia_stealc_tofsee.exe CA87D92F6FA715E3D574F050C8F478B521F75E6CD0BCF2FEDFB0B1FE52917F94D4A6F0FEDA91377857374731F23AB24E55780391A93CE9A0EE7885DD6F7858EA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5248

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EDF5.tmp

Path C:\Users\Admin\AppData\Local\Temp\EDF5.tmp
Size 473KB
SHA256 7df7d0021607ba9875ccebfda4d25fb1ca011944ae12e68cf073e46d44f46031
MD5 b5c4b0e66e25f61343ced92e86bf1e4c
SHA1 0ac78879841543c995d9c1d2ae1edc0e2193e3d3
SHA512 dfc27b9a64740942a68dd487572619e4c21d19645650f6f8505adda23916fa9257069df1e1ef2824547c459fcbf4cfc4af9b58fe1b19f0f5532afe589f679254
SSDEEP 12288:Nb4bZudi79L8ZANW5IJ5/yAdNQSUxTsnWP0A0a:Nb4bcdkL8ZsW3AnQHTsWX
TLSH
T14AA4E0213182C037E1A716380AE5C7B6A53E7DB14F2268C73B9437AD5EB02E1DA79717
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download