3558ebb91542f77764956a1db28e744f0b87297cf5a05663697e91f2ef89911c

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/07/2026, 22:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5b265548ab7a81b7b7e1b02f08559539_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260717-2sh4pab121
SHA256 3558ebb91542f77764956a1db28e744f0b87297cf5a05663697e91f2ef89911c
MD5 5b265548ab7a81b7b7e1b02f08559539
SHA1 e10aa774b83bf9126095543f03bcfd0c8ec1bf5b
SHA512 f3a59271e8e72b38447deae815896d48a87883d26c0406684ce39d26ea6194c4369a60da6f0e50b8cf9316319170759dd6bc52de92c74dd389abd3d1ebae43ff
SSDEEP 12288:Nb4bZudi79L7DzG7eWK0rdpoIT0MUZKvqI1A:Nb4bcdkL7DSBr7oI7Usv
TLSH
T11EA4E1243581C037E69706384FE6C77A667A39B14B2268C33BD46B7E6EB12D2D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5516	BEA3.tmp

Executes dropped EXE 1 IoCs

pid	Process
5516	BEA3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5b265548ab7a81b7b7e1b02f08559539_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BEA3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6960 wrote to memory of 5516	6960	2026-07-17_5b265548ab7a81b7b7e1b02f08559539_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5b265548ab7a81b7b7e1b02f08559539_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5b265548ab7a81b7b7e1b02f08559539_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6960
- C:\Users\Admin\AppData\Local\Temp\BEA3.tmp
  "C:\Users\Admin\AppData\Local\Temp\BEA3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_5b265548ab7a81b7b7e1b02f08559539_elex_mafia_stealc_tofsee.exe A1FE8ED6CAF0CC75D6804CD4A7AB4E16A376051D9E95291928C19AE63EAB9455CB7B41E8E6CB2247A70E0E1D7355C4881290C77DDFEEADBA6F90E7DD7D43BDA9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5516

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

BEA3.tmp

Path C:\Users\Admin\AppData\Local\Temp\BEA3.tmp
Size 444KB
SHA256 98d2fc94d2d05fff44d680c564620453d1eaebeb2a7ea513210d7a0b26a8754b
MD5 37cd35331348cf4993113d8041c9bc72
SHA1 5d4106468ee9ee05054f09cd853e40e5511f0cdc
SHA512 04e9058fff7d50d794abc64eae3445a33b04948c4eeba61e406226e8ce36ebf70c8f8ef7cc09e062595fbac73b4cd6d5d6090c3ff17c513bca57683809e61649
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStSMGX0sRBD0DBMXuzURSGFWPg0+q6mMUEh+B:Nb4bZudi79L3VPRIMez6mMjhfA
TLSH
T1C8A4F0243582C037D2A701354BE5CB76A67E79A14B26A8C73BD46B6D5EB03E2E730317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download