ab232c393d5704890431906b2da5ec294f30f72b99a3ad3700f875f98f3e80d0

Analysis

max time kernel
150s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe
Size 448KB
Sample260718-eammtsaw4s
SHA256 ab232c393d5704890431906b2da5ec294f30f72b99a3ad3700f875f98f3e80d0
MD5 5b5cb741f88b9ac04b475fa842c15e33
SHA1 1b15bd7194dd21e784b96a12d437a1a27431e690
SHA512 1979473949788d5ab81000c26a76aab957dbd7b74def1548e56f217d5f3f8c7b655a7e6c7ec58248529b102f652db58b536024cb98cce82ed502c06f4f0ff8d1
SSDEEP 12288:lb4bBxdi79L9uJ+SOmXaLYGwRL4bdsNe/:lb4b7dkLEOzk/e1
TLSH
T10DA4E0243182C037D2A325394BE5D73955BA39A14B26E8D73BD4DB7E2EB06F1DA34302
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4776	E8B5.tmp

Executes dropped EXE 1 IoCs

pid	Process
4776	E8B5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E8B5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5864 wrote to memory of 4776	5864	2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5864
- C:\Users\Admin\AppData\Local\Temp\E8B5.tmp
  "C:\Users\Admin\AppData\Local\Temp\E8B5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_5b5cb741f88b9ac04b475fa842c15e33_elex_mafia_stealc_tofsee.exe E7ABE88A11F368589E51B98BB7A22ADDCDC4A26509A370BBC7B830477C9FACF00544D7E52F018260060E7C2844B4F983803DDFE145D950CFEA6FF4A1A9130DC8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E8B5.tmp

Path C:\Users\Admin\AppData\Local\Temp\E8B5.tmp
Size 448KB
SHA256 9ef655a65657232b20bee1f1e129a8dd99dd77381a97356e76110054b566cdf7
MD5 3503ebc5c5f15a7b572a2fba9f4ed4f6
SHA1 bacf54b2457c73907a1c1bcc300cde06161e792e
SHA512 989797b5ddf67b33ab169eb1ca7b6341478318ed69797bbcd016e64936f9718b54fd489634fcf7c486601123ed0dff79aa6a86ffe8158618dcc2fd607313af45
SSDEEP 12288:lb4bBxdi79LjapjhKFwoR7CfZpJs6mH4p:lb4b7dkLj46D7CfZjmHc
TLSH
T1EBA4E1203582C037D1A329390AE5C77595BA79A11B25E8D73BE8DF7F5EB02E1DA30316
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4776-5-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/4776-8-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/5864-0-0x0000000000400000-0x0000000000479000-memory.dmp

Download

memory/5864-6-0x0000000000400000-0x0000000000479000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads