08013f16119b299ff2ce3d8b582cd2099bd320e7f689fdd2c9b8bc638dd7c515

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
18/07/2026, 07:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-18_5c0911fe12bd4e7f046e18a72929c1b7_elex_mafia_stealc.exe
Size 435KB
Sample260718-jrcleacy9n
SHA256 08013f16119b299ff2ce3d8b582cd2099bd320e7f689fdd2c9b8bc638dd7c515
MD5 5c0911fe12bd4e7f046e18a72929c1b7
SHA1 a82bedfd22f8b5aa2563c7c2d9e61f0b6efe2d07
SHA512 dc287c32fc82db9ad42c37fcbea8435e27111b72c5f52175b86d0c91c96757d6d81be450153cced76f03163979e6305619ec1e0566a670bfe9bec23141757907
SSDEEP 12288:9W4ufepiqKQ1m2ViuPYnO3MTl4n0lUYyJ:9W4ufepiqhmZ8YOm4n0lU1
TLSH
T19994E0213282C036E1E705398BF1DBA9597A7D644735A8C737C42BAE6E742C2DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5708	73A.tmp

Executes dropped EXE 1 IoCs

pid	Process
5708	73A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	73A.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-18_5c0911fe12bd4e7f046e18a72929c1b7_elex_mafia_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 5708	2840	2026-07-18_5c0911fe12bd4e7f046e18a72929c1b7_elex_mafia_stealc.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-18_5c0911fe12bd4e7f046e18a72929c1b7_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-18_5c0911fe12bd4e7f046e18a72929c1b7_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\73A.tmp
  "C:\Users\Admin\AppData\Local\Temp\73A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-18_5c0911fe12bd4e7f046e18a72929c1b7_elex_mafia_stealc.exe CD072C1DF9499B5FF6FAD5FBEDA4A653294ADEB7C8F28F5FD018387BABA88B5C8AFC8FDF75BF198AA846A0716EBD902F7F805E5417D40FC3873EB1ABC30D775C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

73A.tmp

Path C:\Users\Admin\AppData\Local\Temp\73A.tmp
Size 435KB
SHA256 1d8b9a3bd1cc9c3e19bf4558f7420af37d558afbf810d14c2133556844ee0d75
MD5 262d18ae0490d701da488c0d4d4dae83
SHA1 fad4b1414f0cb09dcc0d9366dd16d6a63c610867
SHA512 f26ea3dc484ef3b33b3b69f580185671273ede1afcef45b5eb3a8c313d510bc9786795fd072b7bb6ba8e0f22a49f6a75da94e8ba382bea40fbda8d7e131bcc2f
SSDEEP 12288:9W4ufepiqKQ1mOjG5zpQGz5YCX3MpDVVonSDfH9J:9W4ufepiqhmOjG79XcdLDfH9
TLSH
T16694E0317586C037E1E70A354AA5CBA9696A7DB40B36A5C73BC42BAE6F742C1C730347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download