ea5425c4255a39aa306e01d1856b06478252a074f0264f57e5fe5bbab79a203e

Analysis

max time kernel
148s
max time network
146s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/07/2026, 17:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-19_48ae0ed27151ea716c38b8682ea6f1b2_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260719-vmbzvsft8m
SHA256 ea5425c4255a39aa306e01d1856b06478252a074f0264f57e5fe5bbab79a203e
MD5 48ae0ed27151ea716c38b8682ea6f1b2
SHA1 efce347655e8f27dea571ce6aec04bdff4826993
SHA512 3cfe8ba59320c7203fec4259b1126ab4b9494bf8d25cc46a7e6899648ae1e89d58bf0de9f475a69638c306bbde03db14b1bcf53019f95f4a4500df82c306bf13
SSDEEP 12288:fd4x+ePixnXQjwYQJdpCKdbPf9MZS24wP:fd4x+ePixAjGdCKdbP84
TLSH
T14094E1213586C036E1A706344BE5DA66593E7DA04B3668C73BD02BBE6F702D1EB3435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5444	6F3B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5444	6F3B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-19_48ae0ed27151ea716c38b8682ea6f1b2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6F3B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 5444	2996	2026-07-19_48ae0ed27151ea716c38b8682ea6f1b2_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-19_48ae0ed27151ea716c38b8682ea6f1b2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-19_48ae0ed27151ea716c38b8682ea6f1b2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Users\Admin\AppData\Local\Temp\6F3B.tmp
  "C:\Users\Admin\AppData\Local\Temp\6F3B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-19_48ae0ed27151ea716c38b8682ea6f1b2_elex_mafia_stealc_tofsee.exe 40B9F150A061987A46ED76608FD20DD22AD93AC5F94B45ED8EABA8958C7F6878AA6421B105ECC172E69909710E1EC0CA1DA83C4F0F0B3A472ECE1C312F81E207
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6F3B.tmp

Path C:\Users\Admin\AppData\Local\Temp\6F3B.tmp
Size 435KB
SHA256 0e40f85a4efa0cac856213bc4c6cbd4382a097cd10a9cc8bc057a92c224d771e
MD5 11f4525eb1acdf738ab31f91b2d1bba5
SHA1 e198f6a25621424c837d7e0898983b9b147f976f
SHA512 4d97ff8a750df5327e226b94f98bc42da1a77354db1716b74db75e1a368a423e852af0a251cc8fc868bab16f86994e7e98a093b1f0869c226bfb88108bc92390
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYZWsZVRwSQfpprbUgBMB9y8H/gdcSgKbxu3w9J:fd4x+ePixnXQjnsZVR/Qfr65k9A3wP
TLSH
T17394E0213682C037E1A315388BE4DAA955797DB44B32A8C73BD42BAE5F742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download