b5a974fbc0ff5c3b5339b2bd6a4afba9f15ca58c8b21627d2a01fdaa1c137ab4

Analysis

max time kernel
148s
max time network
114s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
20/07/2026, 18:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-20_05f4acd0dbb0a2e694bc1214a41616ec_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260720-wt77baay3m
SHA256 b5a974fbc0ff5c3b5339b2bd6a4afba9f15ca58c8b21627d2a01fdaa1c137ab4
MD5 05f4acd0dbb0a2e694bc1214a41616ec
SHA1 659fbd39a5f242a8c30b06cc100b3065aa606375
SHA512 39b56b1fbfa2f6db90f8c5db6d1b359e414b266e65cde4bc97e46695268fbe2a9d4950a2146c247c65ac3a6097876669171e04d164cd8bdaa5c890f3481785f1
SSDEEP 12288:aO4rfItL8HRDimrEG0VKEHOwflR7pO6BzYy7K9wlsDpVFd:aO4rQtGRuzkdwRLzYy+9wlsDpVFd
TLSH
T14FA4F1267281C233D29301751BEAC7E6A73E75B01736A4C33BD4426E1FA4AE1C77635A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5536	F19E.tmp

Executes dropped EXE 1 IoCs

pid	Process
5536	F19E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-20_05f4acd0dbb0a2e694bc1214a41616ec_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F19E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2840 wrote to memory of 5536	2840	2026-07-20_05f4acd0dbb0a2e694bc1214a41616ec_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-20_05f4acd0dbb0a2e694bc1214a41616ec_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-20_05f4acd0dbb0a2e694bc1214a41616ec_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2840
- C:\Users\Admin\AppData\Local\Temp\F19E.tmp
  "C:\Users\Admin\AppData\Local\Temp\F19E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-20_05f4acd0dbb0a2e694bc1214a41616ec_elex_mafia_stealc_tofsee.exe 8175FAFBD34B4A3D414FF63A327525ABF8ABA645888ED9A6AEF108B931A8553372EB3066FD559909B24B6E9276A59AAFE446A329802DC03BF1CD7417DAACB36C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5536

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F19E.tmp

Path C:\Users\Admin\AppData\Local\Temp\F19E.tmp
Size 476KB
SHA256 7598d00d5a0805413edbec7190ee1b3cd0e3afdb0eee42f3a2a268b4e0d357d0
MD5 6705dbfc765e302bf4ccbc0d2a84f83c
SHA1 481a89d0050e6e282478bdc9e47bd767f40a9534
SHA512 8d3e7f7e408b4d95a063e548206409de7bf15abd58f4d103f900a3ff3c5f41c01d0b2bb5c6d3230929426171f5291fa9dd6951a4129deecaa5970423d405f83a
SSDEEP 12288:aO4rfItL8HR3UZymslElfwI8/rY0Uj9QUOTce87K9wlsDpVFd:aO4rQtGRWynI+MqUA8+9wlsDpVFd
TLSH
T17CA4F13676468133D29301744BE6DBE6B63E74B40726A4C337C8427D2FA1AE1E73A356
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download