f527016c6369f55227c6cfdbc5b04ce2579818e5ced1d5a08efd02f1c1dd79b6

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 04:03

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-17_4869dadc70db7837c23e31fcb44fbd9e_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260718-emllasfx7r
SHA256 f527016c6369f55227c6cfdbc5b04ce2579818e5ced1d5a08efd02f1c1dd79b6
MD5 4869dadc70db7837c23e31fcb44fbd9e
SHA1 cb4e24c51fd8fb4d432fdc8128c0ec4d46c946bf
SHA512 e75e603a4e62796079fee514d3b5e3f8b656a0514fd7c4d925d208e8c7ca438b9bc25839c7635dfa7974410356f1375e924bd213be723a2b2e99a1730e2c8f00
SSDEEP 12288:Z594+AcL4tBekiuKzErzE4Wztv4SYWidYI4LFstkgRckSukAzl:BL4tBekiuVrHWRYWiqXLFxgRgXAz
TLSH
T1AE94F1253482C037D2A701344BF187766ABE7AA50B2668C77BD40B7C5E656E1EB3438B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2452	5857.tmp

Executes dropped EXE 1 IoCs

pid	Process
2452	5857.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-17_4869dadc70db7837c23e31fcb44fbd9e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5857.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 2452	3116	2026-07-17_4869dadc70db7837c23e31fcb44fbd9e_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-17_4869dadc70db7837c23e31fcb44fbd9e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-17_4869dadc70db7837c23e31fcb44fbd9e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Users\Admin\AppData\Local\Temp\5857.tmp
  "C:\Users\Admin\AppData\Local\Temp\5857.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-17_4869dadc70db7837c23e31fcb44fbd9e_elex_mafia_stealc_tofsee.exe 8D01A0DF269CDE4666D2AE7C5C40F5535F7C0A743218D8C20C9F32DE9E1D2B4ECF8A583719B7284A4B904B99919455971279B33F883546DF9DC439AFE8A6BB99
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2452

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5857.tmp

Path C:\Users\Admin\AppData\Local\Temp\5857.tmp
Size 428KB
SHA256 c6eeea3a1972b0781ce03a49c67e58721ca8cbb8ea21bd7cf113e73dcf125c29
MD5 f1fb71976c88f59b6d70ea0b43d038cc
SHA1 bae304b93697d4cf1a5db42c362d0a46d906c71a
SHA512 b575a46c2e4ddfacc9303ed4eaf76db93e90bdca3617994699adf0a638778869f8b5340d0bd781aa14e17e2646a858b43eb8c6678eb57fd64aa286b2dba77658
SSDEEP 12288:Z594+AcL4tBekiuKzErarxugAcJR2WYD9+c43/l:BL4tBekiuVry0cJRjYJds/
TLSH
T11994F0313582C033D2A716380BF5DB665A7E79B64B16A4C77BD01BBD2E602D1E638347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download