b0a52a4899297e1a8f89f1b7b3c8fae1b049a341dbe780eaef0b4b1e0fa4ae61

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_615bad5bd488492375ad9e6fe69dae68_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260718-d7cy8aav6x
SHA256 b0a52a4899297e1a8f89f1b7b3c8fae1b049a341dbe780eaef0b4b1e0fa4ae61
MD5 615bad5bd488492375ad9e6fe69dae68
SHA1 1bd8ea68da6c214c9715787f06b2a13eb134a296
SHA512 0f2d3aee014db1e62e28169b96c2d4a3b5e0f1f501aedd2905d0075c1367a2595853c4c77926725f53b8fbb198c11687b18e5d8b58a00164e17277edacf35312
SSDEEP 12288:3O4rfItL8HPeKH7CHjhBl/9b85bQaciQ7rKxUYXhW:3O4rQtGPeKbIF/9sbQdv3KxUYXhW
TLSH
T1FBB4F12A7682C233D2D302355BD6DBE6663E78750326A4C337D4427D1F61AE1E37934A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3588	51FE.tmp

Executes dropped EXE 1 IoCs

pid	Process
3588	51FE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_615bad5bd488492375ad9e6fe69dae68_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	51FE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5220 wrote to memory of 3588	5220	2026-07-17_615bad5bd488492375ad9e6fe69dae68_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_615bad5bd488492375ad9e6fe69dae68_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_615bad5bd488492375ad9e6fe69dae68_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5220
- C:\Users\Admin\AppData\Local\Temp\51FE.tmp
  "C:\Users\Admin\AppData\Local\Temp\51FE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_615bad5bd488492375ad9e6fe69dae68_elex_mafia_stealc_tofsee.exe 425790F8D6CB457E2271AB5B2D81A97DB480F9AE5E7583CDB64E311E63925EE63A29C51942BDE7227F7218BE35E9D46ECCE722D04E31ACD566B67ECB06170104
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3588

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

51FE.tmp

Path C:\Users\Admin\AppData\Local\Temp\51FE.tmp
Size 486KB
SHA256 b3e3cd696f24babf13c0d1a9a7607af6854ca326b44bf76e519eb9748c27641b
MD5 f011c84f09c7d3c5c63e167424edaa5b
SHA1 321801673fc588a76d25b177a9ce8efdf90acda2
SHA512 772d5f46087cce91f9b3083dde2ee17027d9f396a01b4d9fb7b6b8b15df02d913de2f4f6f2543dc4eef2525210e0f400450a05f932d17ba628bc13a1cea42a2f
SSDEEP 12288:3O4rfItL8HPOFtSDchRWOkUEgT5y45h9eeOXmgd87rKxUYXhW:3O4rQtGPO+u865y45h9e9Wy83KxUYXhW
TLSH
T1B2B4E12677818233D2D201711BDADAD6BB3E79B1472698C32BD8027D1F61BE1E37534A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download