f65963cfe2e79f43d112ce4fb8edfba7dc87334ab2494bc8f539e05249b55cb1

Analysis

max time kernel
148s
max time network
125s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 05:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe
Size 435KB
Sample260718-gn53fac19t
SHA256 f65963cfe2e79f43d112ce4fb8edfba7dc87334ab2494bc8f539e05249b55cb1
MD5 e74d1b7ed17ed801a284bf876c770488
SHA1 568921368696597ebf7710355751a8473f7e6c25
SHA512 13d24895fc06c05c027608c2dff9da0ede50c61eef17e4cab565e3a44fd47dc09060b556dbd6507a4ee84a7de5c63f55685ae4eae7b11ab31a913c046eae712e
SSDEEP 12288:9W4ufepiqKQ1m0geI1VD49stsoTVnJG5TF4J:9W4ufepiqhmRs4soTVnI5h4
TLSH
T1CD94E1253186C037E1A309394BE5C766697D7DA44B26A8CB3BC02BAE6F742D1CB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1292	82C3.tmp

Executes dropped EXE 1 IoCs

pid	Process
1292	82C3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	82C3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2688 wrote to memory of 1292	2688	2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2688
- C:\Users\Admin\AppData\Local\Temp\82C3.tmp
  "C:\Users\Admin\AppData\Local\Temp\82C3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_e74d1b7ed17ed801a284bf876c770488_elex_mafia_stealc.exe BE7BE82D3519A4A7935A6B08BCE0C2841A33859589EF053F0489BCB64B73F75BD2B0C942BC8C8E978A0507539F45FE277763B189FCC88EC3AC7BA67D02AB5895
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1292

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

82C3.tmp

Path C:\Users\Admin\AppData\Local\Temp\82C3.tmp
Size 435KB
SHA256 4d10b127e526ce4ce32ed898eaa4499c3a36d41a9be8ffbbcedfec7b55471198
MD5 610c240e1157fca6a8ef934d49ae8ba9
SHA1 76862de004a185e05380c222e8550c90a183ddf2
SHA512 7438d5cbac0a9b487c07a14e2b53b5f591806b30f54f809a9beb82eb0b1816b6d3accc6d7356d8e0282899acffe4b7eac72e60ed570ea957e97c97f45f95f93d
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBY4eFUUrSnJBrEWekvE7IE4lPcmbHVJK:9W4ufepiqKQ1m4KfvekvEJRcJ
TLSH
T10594E0207182C037E1A706344AE5DBBA597D7CA55B36A8C73BC02BAE6E742C1DB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download