c38a2d26343f87cc35863f8324046c0587ce2f95951d99a67fc3d0e09e963564

Analysis

max time kernel
150s
max time network
124s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 08:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_46bf3b52f6e762f8e0e4655122636b1f_elex_mafia_stealc.exe
Size 435KB
Sample260718-j244eagx2s
SHA256 c38a2d26343f87cc35863f8324046c0587ce2f95951d99a67fc3d0e09e963564
MD5 46bf3b52f6e762f8e0e4655122636b1f
SHA1 54d609b919e9dc2929ea99899259668893ec091b
SHA512 325bc6f9b20ad452ebe4585f1e1bd15d92496e2fe7dad0bb2f1fc99fb83ecc7c3b0646fe2b4c7ae87abd0d806fbb11333acf29de1e3338045704236ac7cb6488
SSDEEP 12288:9W4ufepiqKQ1mN9wwll+9uYgrBvnK++JaLPBsEEVJ:9W4ufepiqhmN9wwrQuPrBsaLPBPEV
TLSH
T1C394E0207586C037E1A309354AE5CBB9997E7DA14B32A4C73BC427AA6F742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4256	D121.tmp

Executes dropped EXE 1 IoCs

pid	Process
4256	D121.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D121.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_46bf3b52f6e762f8e0e4655122636b1f_elex_mafia_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4256	4300	2026-07-18_46bf3b52f6e762f8e0e4655122636b1f_elex_mafia_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-18_46bf3b52f6e762f8e0e4655122636b1f_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_46bf3b52f6e762f8e0e4655122636b1f_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\D121.tmp
  "C:\Users\Admin\AppData\Local\Temp\D121.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_46bf3b52f6e762f8e0e4655122636b1f_elex_mafia_stealc.exe 435BD743B5E8146DA1EB59B23E9B11A9B03139C0F3DAC759A1904BA655B23767F0506990DA5FB2F941005875E2127E40725276E5057D4C5C92E749AEA6DFF2C9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D121.tmp

Path C:\Users\Admin\AppData\Local\Temp\D121.tmp
Size 435KB
SHA256 d3c030f0006445cfff0d3fe5b3264e25ccda7e59a0bdf588cac3404de748b3cc
MD5 631beabd21251a1b523f22594aa395ae
SHA1 4de435e147a968286b539ef9d69c65696cc5cf0f
SHA512 7b288c142e8f0c80fc9e08392a995e87247ccb16e9a5069ec71495ff7837173324205b8cd658dbcf0174e974e936e35faedec5b6c710f54ba5a16aee1c0045c4
SSDEEP 12288:9W4ufepiqKQ1mhTH60TDDGKyr+kEMX4Sgha0hAJ:9W4ufepiqhmhz60TPZS+kEMIFhaSA
TLSH
T1CB94E1253642C037E1A305344BE5CBB9697A7D614B35A8C73BC42BAA6F746C1EB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download