5f5ce8a55221fbbd393fa1ddb2b3f2d72a1ae5ca9cc6b9d3ee9feab72bc608ce

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
15/07/2026, 03:14

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-15_1c308bd5f6e5bfcc59a305f43ad1e335_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260715-drrsfaax5n
SHA256 5f5ce8a55221fbbd393fa1ddb2b3f2d72a1ae5ca9cc6b9d3ee9feab72bc608ce
MD5 1c308bd5f6e5bfcc59a305f43ad1e335
SHA1 464a21c776161b11fbd31a1dc580711f9c36b332
SHA512 061587c06dab365b5158f001bb935fa9dc2556c00946921e88ae82ea7e86a97f2757f173c15dd51e0e647807fec14fc3f94b1e42675a0c6d4b6bf8b523035f29
SSDEEP 12288:Wq4w/ekieZgU6A+Dz3r2VPInFJ31pndr2l:Wq4w/ekieH6A+DjalwJlddS
TLSH
T13794E0247582C037E1A706344AE5CB7A693A7DB14B36A8C73BD42BAE6E742D1D730307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
824	8265.tmp

Executes dropped EXE 1 IoCs

pid	Process
824	8265.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-15_1c308bd5f6e5bfcc59a305f43ad1e335_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8265.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2324 wrote to memory of 824	2324	2026-07-15_1c308bd5f6e5bfcc59a305f43ad1e335_elex_mafia_stealc_tofsee.exe	87

C:\Users\Admin\AppData\Local\Temp\2026-07-15_1c308bd5f6e5bfcc59a305f43ad1e335_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-15_1c308bd5f6e5bfcc59a305f43ad1e335_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2324
- C:\Users\Admin\AppData\Local\Temp\8265.tmp
  "C:\Users\Admin\AppData\Local\Temp\8265.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-15_1c308bd5f6e5bfcc59a305f43ad1e335_elex_mafia_stealc_tofsee.exe 2F1DF64B1B3E5C7F50131F948D441FE263CDB59EA7C7AAD9B5E7C54D1932A452403C6171AF1D239083924F360CC8AD2BED59BD962784BD719A8580777EA3FE76
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8265.tmp

Path C:\Users\Admin\AppData\Local\Temp\8265.tmp
Size 414KB
SHA256 d995497f3ca01381ee57fc1bb89e9709c71d9e07dacb663c4d6be79e93fc6fc9
MD5 bfeab0237621bc8b0863cbe98dc449de
SHA1 5df46e2e3cd8fb34905b0b0762a7c235d34c975e
SHA512 9033e2624d478ee7b982a7741d785bd96f2a26613b0f2c98bffa6ae53210598715569e67eedd93b30b7a7235c0b2e8ba72dbe399a781e2a2d4b099d7f42459a4
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYBf55s9HHFiaafUI37vUGitET41o7zl:Wq4w/ekieZgU6YstHw9fUlGoO4u/l
TLSH
T11794E0303586C036E2A706354BE1CB69697A7D754B35A8C73BD42BAE6EB42D1CB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download