abce6e0e820b79e5d5ebfd07422bc9406b3e29fc8077fbfdda3aaa211ca06b16

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_c51ace1d612ba2c56a09a82b90ca6991_elex_mafia_stealc.exe
Size 435KB
Sample260718-cmefwacz3r
SHA256 abce6e0e820b79e5d5ebfd07422bc9406b3e29fc8077fbfdda3aaa211ca06b16
MD5 c51ace1d612ba2c56a09a82b90ca6991
SHA1 7c4545d8d266db2324c8cb2f062958430041b0a5
SHA512 ecb1eca354214f4e92b945b48d4076f4597d9637a7a62aeeefdbe3219084dbea6f553c6e89c58fa020255b8c6c7a9f470d5bd8a3d1a4768aa393a44bafc8ab00
SSDEEP 12288:9W4ufepiqKQ1mztKXYtnkqXOMDFIvf8tmmOJ:9W4ufepiqhmGakqXOGF2M1O
TLSH
T17C94E0257582C03BE1A609358BE1CBAA593D7DA44B32A4C77BC02BAE5F742C1D73534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4800	11E8.tmp

Executes dropped EXE 1 IoCs

pid	Process
4800	11E8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11E8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_c51ace1d612ba2c56a09a82b90ca6991_elex_mafia_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4820 wrote to memory of 4800	4820	2026-07-17_c51ace1d612ba2c56a09a82b90ca6991_elex_mafia_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_c51ace1d612ba2c56a09a82b90ca6991_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_c51ace1d612ba2c56a09a82b90ca6991_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4820
- C:\Users\Admin\AppData\Local\Temp\11E8.tmp
  "C:\Users\Admin\AppData\Local\Temp\11E8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_c51ace1d612ba2c56a09a82b90ca6991_elex_mafia_stealc.exe FB5E8EBF5A55C56776699DB2AA0890B1C812E0E8CEA94FBF0E5D34143B9BC4A6B08F6FF7C9070D1D02C5521AA4A53FB256BE1A693EF934CC5786F12AFC92706D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\11E8.tmp
Size 435KB
SHA256 83ac8f196a9c272d6d413aa7c96c4b34dde7ce56e243e3b3f2e3f693bd6ba23a
MD5 b7a9b8c7551f9b128c7beac7cb9c48e3
SHA1 6fcc5484089402b459de89f3c695de69998b7e69
SHA512 ecad22f766b55d4baf1376a14463410f4fe1c9636582f3f8610012f3ac06f1d7f7901cdaf5e278d4e90bab171ed526f9b2774df631ccb213fa4f16b225226d46
SSDEEP 12288:9W4ufepiqKQ1migGH9G+vd3gvgKIKr3TQJ:9W4ufepiqhmrGnd47Bbs
TLSH
T10394E1317282C036E1A306384BE5CBA9597A7DA54B35A8C73BC027AE6F746C1D73534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download