48fba0ea7079f25690aaa32e7fb2283d8cf89d8c200b223a7910c63cf7ac9f3a

Analysis

max time kernel
148s
max time network
127s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 01:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_dd1c7850fcdbb31b6cb5bb0dada20b94_elex_mafia_stealc.exe
Size 435KB
Sample260721-bgh2faaz8k
SHA256 48fba0ea7079f25690aaa32e7fb2283d8cf89d8c200b223a7910c63cf7ac9f3a
MD5 dd1c7850fcdbb31b6cb5bb0dada20b94
SHA1 609c5082b8fff978942d38f6f0949e2aa5e02c30
SHA512 9dc69ad0c6a171dd4761544af08a516aaeb597bab55c502425fe7c2424ffee18d5dcd1acc15314a60b0dc98df192b1dd6e4cd606cbfd9f05589e49e673725ad4
SSDEEP 12288:9W4ufepiqKQ1mtdMRpbaKLgs6uF2mseJ:9W4ufepiqhmPMR1RLgQFrd
TLSH
T18894E1217286C037E2A315348BE5CBA95A7E7D654B32A4C73BC02BAE6F646C1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3752	D9DC.tmp

Executes dropped EXE 1 IoCs

pid	Process
3752	D9DC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D9DC.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_dd1c7850fcdbb31b6cb5bb0dada20b94_elex_mafia_stealc.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 3752	3632	2026-07-21_dd1c7850fcdbb31b6cb5bb0dada20b94_elex_mafia_stealc.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-21_dd1c7850fcdbb31b6cb5bb0dada20b94_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_dd1c7850fcdbb31b6cb5bb0dada20b94_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\D9DC.tmp
  "C:\Users\Admin\AppData\Local\Temp\D9DC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_dd1c7850fcdbb31b6cb5bb0dada20b94_elex_mafia_stealc.exe 38F5D38284ED33949B4CDE919B38467536995EA9F12E1F871A17E3EB7F4A572BDA3EB4A163706BB962393A877AFE159DC547066FA42460729FAD53F3EBE5CE82
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3752

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D9DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\D9DC.tmp
Size 435KB
SHA256 93539716df25f2a02ead340849803b44c8165f83dbb27af047c7fd8816027821
MD5 c8be952a9bbd2e2581355cb0d77ab4a5
SHA1 ab2c98b3fd4c8bc3d88a008f3b9d8b18773d0265
SHA512 39444e619e1acd53c8760087c29555e38958480c43ae389481cbc6f465f06a2fb266eef6deaf711cd1a6e2c67c61c7777cbfb168364e1d012f79e2ceb08807ba
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBYRhiuOLqSc0xYr/qrM0R0BuOIe2tkUloJK:9W4ufepiqKQ1mWhqLqj/QM1lIewk5J
TLSH
T1D694E1217682C037E1A615358BE1CBA9597A7DB14B35B4C73BC42BAA6F342C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download