84f4b83df651cf5edfbc6e54cb88ec44b8620c87dab62ae2eb83a211fb4a7a06

Analysis

max time kernel
148s
max time network
130s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260715-dbd7eaas6q
SHA256 84f4b83df651cf5edfbc6e54cb88ec44b8620c87dab62ae2eb83a211fb4a7a06
MD5 5c4ae4de7e674cc5e5b9e1deef73c123
SHA1 b50c5bf6ec7c6fe5d80058a2fc4d5ff83a3763f6
SHA512 da3745a9dcac86caadd17b6a5a393a4a64365c929c441a46bb2b8d1180f5b06869faa189306782992c5a88b19725137c1c6d38c581b63fd938b27def6ef444cd
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYd5rXCiF6K3nRsjF9wiHg/Dy7AWZx9w9J:fd4x+ePixnXQjgrVnOwirRZfwP
TLSH
T1FB94E0213582C036E1A309354BF5CB6A693A7D754B76A8C73BC42BAE6E342D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2124	35EB.tmp

Executes dropped EXE 1 IoCs

pid	Process
2124	35EB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	35EB.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2692 wrote to memory of 2124	2692	2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2692
- C:\Users\Admin\AppData\Local\Temp\35EB.tmp
  "C:\Users\Admin\AppData\Local\Temp\35EB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_5c4ae4de7e674cc5e5b9e1deef73c123_elex_mafia_stealc_tofsee.exe FB574381789E93A0BB72545A482BED24D307AA1C0AC886C797A3C2DCF10A7835EF276131ADBE9D181A7B70CDCED8AFA09A8C9D2A8E2E767CE28A5339D9BAAA7E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

35EB.tmp

Path C:\Users\Admin\AppData\Local\Temp\35EB.tmp
Size 435KB
SHA256 77271bd0a7a184c5c22eb4109f2c5caf0650a3247e17b663efe9ba719ca026da
MD5 0cfb208c9c76eea0c37c6abd12ae7fe4
SHA1 8314a903ad8d22ac238a4404dcdd2afe6fa9c624
SHA512 83d654dfc9beb94f883572a044816a51c49e1588e623be39197a1dba01619e5537fb5db7e8852059c17516f594684005f4115938ad689bbbfaf532da93ddf826
SSDEEP 12288:fd4x+ePixnXQjKxovEqOewKfl93wZjXclwP:fd4x+ePixAjDWewylFwZjMl
TLSH
T11194E0213582C037E1A71A384BA1DBB6593D7DA14B32A4C73BD42BAE6E746C1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download