1e577e2be7037bb2fb15ce6513381b371a1119626b927eb4820bf8f05d7802ca

Analysis

max time kernel
148s
max time network
123s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260706-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260706-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
07/07/2026, 05:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-06_05392304a477c1093e5ea04e6bb7cb69_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260707-gepdbsay71
SHA256 1e577e2be7037bb2fb15ce6513381b371a1119626b927eb4820bf8f05d7802ca
MD5 05392304a477c1093e5ea04e6bb7cb69
SHA1 ac2ffc4e295f436c3c85d490cf797f7ec43da4a1
SHA512 ce92a26e0ab335e3234e4028c0fe1636456096ed4c5c8927369d28ebc989e11120bba5d4af62e382e29b00039f9ddc78441141c914c02c9ad08e6a7a7f2d1ce2
SSDEEP 12288:Nb4bZudi79LBOHvlASCqok4SluCC9AHjlQkeg1HYA0a:Nb4bcdkLBOPytq7du99EjlpdL
TLSH
T175A4E0203591C037E29712340AE6D7B5663E7DA09F62A8CB3BD077AD6DB06D1DA38317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6072	44EF.tmp

Executes dropped EXE 1 IoCs

pid	Process
6072	44EF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-06_05392304a477c1093e5ea04e6bb7cb69_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	44EF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5676 wrote to memory of 6072	5676	2026-07-06_05392304a477c1093e5ea04e6bb7cb69_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-06_05392304a477c1093e5ea04e6bb7cb69_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-06_05392304a477c1093e5ea04e6bb7cb69_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5676
- C:\Users\Admin\AppData\Local\Temp\44EF.tmp
  "C:\Users\Admin\AppData\Local\Temp\44EF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-06_05392304a477c1093e5ea04e6bb7cb69_elex_mafia_stealc_tofsee.exe FBAAA3AE449E438AAB7C33F48AC32DECD0ED3ABA2020B34F6B7F3462398009DD2321A9B494F1CDFDFD675C5E5D5A1BB1E1B083F4405BEABB37AFADEFCD7E37A2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6072

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

44EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\44EF.tmp
Size 473KB
SHA256 78288c683fbe49b5a4456ccd9f54cf370bf5a670fc25a9bf6fd3b98070d04cc7
MD5 905ac72def80e64baf0eb9a69f82fad6
SHA1 3ae8bf3debaa219014ee9718b667753ec2cd981a
SHA512 a0c93bd7f199cc0f6147fc554553fec85c2a712d2eac8109bcd2755b6ef581f4ea4a8505845c22277a06931c9a59152ae0f302d20bf5b6816295552aba6dac43
SSDEEP 12288:Nb4bZudi79L3mrh1CweZJRv4MrD4NqA0a:Nb4bcdkL3mrveZL4Mv2B
TLSH
T1F7A4E0243182C037E29B11344BE6CBB5693A3DA15F6168C73BD43BAE6EB02E1D635357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download