5def6e0c3075facad698134749c80b7943c5f83287077f85a1c49035dad1523a

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/07/2026, 12:29

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-11_c0c61ce8cd0943f756ac355380972bd8_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260711-pn1fyscs8s
SHA256 5def6e0c3075facad698134749c80b7943c5f83287077f85a1c49035dad1523a
MD5 c0c61ce8cd0943f756ac355380972bd8
SHA1 4d84857d97c07f878ceb2b6886e5eb69f2965676
SHA512 7a9e2943a69180c2e344e9492ffe782d9046d85b20fa925f651d826a678141fe9bc0c13a41608733df016e7f381ac91c17ab71a6f98940987d740be6c67545be
SSDEEP 12288:ts4acekuGg/tGyM3Nh88YDtWKb+b3jf2mNURX:ts4aceku/txCNh88Ypib3jG
TLSH
T1EB94E0257686C037E1A305398AE5CA6659397DB50B32A4C73BD42BBE6F382C1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6064	43C6.tmp

Executes dropped EXE 1 IoCs

pid	Process
6064	43C6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	43C6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-11_c0c61ce8cd0943f756ac355380972bd8_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5360 wrote to memory of 6064	5360	2026-07-11_c0c61ce8cd0943f756ac355380972bd8_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-11_c0c61ce8cd0943f756ac355380972bd8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-11_c0c61ce8cd0943f756ac355380972bd8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5360
- C:\Users\Admin\AppData\Local\Temp\43C6.tmp
  "C:\Users\Admin\AppData\Local\Temp\43C6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-11_c0c61ce8cd0943f756ac355380972bd8_elex_mafia_stealc_tofsee.exe B148FE07674BCEE989C17F9EFC2FAAB3896AC17797817DF80BB9631A3FE3C4993E305C17C1E464C811C03FA3D1D4FA93CA34DEED69BAD816A5FF6FBDE490CEE5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6064

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

43C6.tmp

Path C:\Users\Admin\AppData\Local\Temp\43C6.tmp
Size 435KB
SHA256 57a5ff96f257b3d6ac208ad466fa2e97407a1fe6aa93e931b40de753f1f07c97
MD5 089b877323ec9e7a744ca98b391ba4e8
SHA1 b3dd37bf2c45cfe2afd16d9c5727c35a45163c83
SHA512 9f53da650c9925fdedef6398dff8b0206450e9b7f24f4b2182babdeff06c0afc8cc0a506f5457360be69d54a525441caee3327a53a160c4a41b7ef5f0805c94e
SSDEEP 12288:ts4acekuGg/tbsoWV9YVv+hs52HsorWFp4bX:ts4aceku/tAUVvYsWY4
TLSH
T11F94E1247582C036E1A715344BF5DAB969697DA10B36E8C73BC03BAE6E742D1DB3034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download