0d5c6340f4292be04e9e28e53f153872113398f186688ed6ad99f076ff4ece97

Analysis

max time kernel
150s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 03:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260718-ej56jafw8n
SHA256 0d5c6340f4292be04e9e28e53f153872113398f186688ed6ad99f076ff4ece97
MD5 4c29fd59b7f0815f7b63ec65f9433124
SHA1 a352c8a9b23db4e79eb7bc2b65edfa86a2546f1a
SHA512 7580a523ffb7bb5f8c07dc9f673769c51cbdcdf61c636676ce2aaee4d8587f95cee845b63c3d8e4e7031f5c9b34965a7fb35762ec1498befb888bb7a991a716d
SSDEEP 12288:fd4x+ePixnXQjSzhlItLWTQBMaAduN+RtwP:fd4x+ePixAjIha8QBuF
TLSH
T15A94E0203A86C036E1A715354BE5CBA9693A7DB04B36A4C73BD437AA5E742D1CB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3908	FD5.tmp

Executes dropped EXE 1 IoCs

pid	Process
3908	FD5.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FD5.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1268 wrote to memory of 3908	1268	2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe	90

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268
- C:\Users\Admin\AppData\Local\Temp\FD5.tmp
  "C:\Users\Admin\AppData\Local\Temp\FD5.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_4c29fd59b7f0815f7b63ec65f9433124_elex_mafia_stealc_tofsee.exe 49A2B9B60B0BBB8F041330F93C5837A597C241ADE644F9B44904732252EC383E0DF0BA9CF03076FF1AD6F789BF8FA9843EDC72F46A0E8C16655A2EF8F4ECAFAF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3908

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FD5.tmp

Path C:\Users\Admin\AppData\Local\Temp\FD5.tmp
Size 435KB
SHA256 3977e29ebb4a4610fdc6e49b6f1ec52e2adad1730d56d662a3fab58929c93968
MD5 9035384826de4c0cc0c7c0401b594db8
SHA1 85b9922b6277756a159381487c93ddee5d70af91
SHA512 e65012488d566795234fcb97edc05b2997ad899913ab95c1f2ac0d90882674ae7e5c1aab545081531efed4c7b21c59186f6f6bc6b9ef59636889e33ecf63626b
SSDEEP 12288:fd4x+ePixnXQjUP/6HXle/W2oNeEEv9ZowP:fd4x+ePixAjUngVe/Ie92
TLSH
T10294E0203686C037E1A7053887F4CAA9597A7DB54736A4C73BD42BAA6F742C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download