6cbde4c646f6aa10c04c202810a36e05044728df2043124021e5ff72631a8eb6

Analysis

max time kernel
148s
max time network
113s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 02:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_967cdf413145cb0f57486710c4284c70_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260718-dcejkady7m
SHA256 6cbde4c646f6aa10c04c202810a36e05044728df2043124021e5ff72631a8eb6
MD5 967cdf413145cb0f57486710c4284c70
SHA1 787180b8b03548978e7bfdb2f9fa8d4ca18697c4
SHA512 80d11e2841cf1762f88ad58f302a41e63ea02b46cf391e86d9ab88a43d215ba17d1cb75b65ba1d50b5fa7ac98fd777bf55a1fe9bdb3506948e20eac7e9fff8ce
SSDEEP 12288:qO4rfItL8HGuPlubV05FKKOl5QB4ZBZH4xw97bWmeEVGL:qO4rQtGGuzvKKOl5QB4WaumeEVGL
TLSH
T10DA4F1297240C133D29302750FE6EBA6AB3E75754726A8C33BD4427E2E656E1D336387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4352	DE16.tmp

Executes dropped EXE 1 IoCs

pid	Process
4352	DE16.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_967cdf413145cb0f57486710c4284c70_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DE16.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3532 wrote to memory of 4352	3532	2026-07-17_967cdf413145cb0f57486710c4284c70_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_967cdf413145cb0f57486710c4284c70_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_967cdf413145cb0f57486710c4284c70_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3532
- C:\Users\Admin\AppData\Local\Temp\DE16.tmp
  "C:\Users\Admin\AppData\Local\Temp\DE16.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_967cdf413145cb0f57486710c4284c70_elex_mafia_stealc_tofsee.exe A664B3762E64BAE7585637F49E9692FFF5EBA74C29F1B86F905E61E5DA5DEB4C354F45A6F486FAE67E7207215182CB1A8A9D4AAEC04195DDE33B15274EDA4508
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DE16.tmp

Path C:\Users\Admin\AppData\Local\Temp\DE16.tmp
Size 468KB
SHA256 46fc8c2ae8dceb0f613c02ef2b17e46f68a3a1a1bafc7f8ef9e2a006289ab9d2
MD5 231a2b55502191946fd61674edc483b6
SHA1 c3197a7701451c23ebd142cc05c76727b9d27fc1
SHA512 64246bbeb0aad7c9d25e4134d7cd9c4d0248a73f4b27ad1f0da182eb739c9b1b0cd177e3f7f75705819860a379b82c1f8a3f8b59ed32f75f81f72c75d7d4ab4c
SSDEEP 12288:qO4rfItL8HGjvh8MOd1Dz7Gy/mAlbHaZl4Rh1QD7bWmeEVGL:qO4rQtGGjvh87dJisbHaZl4mumeEVGL
TLSH
T1C0A4F1367241C133D29302350BEADAA6AA3E75B5037694C73BD8027D2F656E1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download