08613f602f7a4629be04269483f2303ead1d7c8c806aca65bfc31cb8e1c37a3f

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
10/07/2026, 21:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-10_ee4fc33e5e7052e8f977dc2a1a04218e_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260710-1mt4bsbs4m
SHA256 08613f602f7a4629be04269483f2303ead1d7c8c806aca65bfc31cb8e1c37a3f
MD5 ee4fc33e5e7052e8f977dc2a1a04218e
SHA1 b3aa6f7e164f72ff4460ac31d34fcc9b4476474f
SHA512 609ef18d2c0462a313cafa2e0168afbc36157f1178261895b5ccfbfe5763bf18b519cacc5291b5fc0a10d6e15a72789215da08b01432f401fa21b4f68831a583
SSDEEP 12288:Wq4w/ekieZgU6rAA5985n5lavpgW+5YKHUdl:Wq4w/ekieH6rAi985no6W+5BO
TLSH
T11694E0353582C037E2A715344AE5CB692A397DA44B32B8C73BD42BAE5E752C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5592	2E88.tmp

Executes dropped EXE 1 IoCs

pid	Process
5592	2E88.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-10_ee4fc33e5e7052e8f977dc2a1a04218e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2E88.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5288 wrote to memory of 5592	5288	2026-07-10_ee4fc33e5e7052e8f977dc2a1a04218e_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-10_ee4fc33e5e7052e8f977dc2a1a04218e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-10_ee4fc33e5e7052e8f977dc2a1a04218e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5288
- C:\Users\Admin\AppData\Local\Temp\2E88.tmp
  "C:\Users\Admin\AppData\Local\Temp\2E88.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-10_ee4fc33e5e7052e8f977dc2a1a04218e_elex_mafia_stealc_tofsee.exe 2F06F18E743A0384737440C711BE986A8738FFC257BE989FD7F61413CC9EBF2B581FA6B9C0D925DFDF3C4C159B20AE39873ABF9B4C911439A1E8C622E1FCC6DF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5592

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2E88.tmp

Path C:\Users\Admin\AppData\Local\Temp\2E88.tmp
Size 414KB
SHA256 f9eb9dbcb9406f5ec68d2ecfc01defb5dc5f95a7408e0d1f90825426080f2e44
MD5 80082df7f103b2011f1e6991ae45a531
SHA1 e9af3e2d3d35fba1706f863e8afd2bb9c0b24142
SHA512 08976c9ee06d293292b0a443479c91637c0bcedbc731c58a0d4bdff36fa04908ae1ef2346b051d3aaf378ba21d748a575609fa2b2b629446fe2a1ed1bb5fc3d1
SSDEEP 12288:Wq4w/ekieZgU6JnNoPKZCtZV3oW3uPMq9l:Wq4w/ekieH6hNoyZ4puPMw
TLSH
T1DD94E0307586C03BE2A716358AE5CAB9663E7D644B36A4C737D427AE6E742D0DB30307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download