b9bc69f52c34f20a7710e0f1b20e23ab47bc83bd45c3459d95fe50082e88cb8a

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 04:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_5c64b9df746af2e198c8bb662d45aa97_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260721-erecsaew5p
SHA256 b9bc69f52c34f20a7710e0f1b20e23ab47bc83bd45c3459d95fe50082e88cb8a
MD5 5c64b9df746af2e198c8bb662d45aa97
SHA1 9896eba906947b2516b358462c1a9eaa889a10e0
SHA512 f3bc93f6ff2d8a7dcecb362cadb294df58e6cefa3877263e3fb5c00f171897c522efc2df40bd3ea29d7f0d6be9e499b54ae1e8e110ec8c64fe98877e9d3be0e4
SSDEEP 12288:aO4rfItL8HRWhz8hnbkPaCSl38hQz2HC07K9wlsDpVFd:aO4rQtGRWokitlqi0+9wlsDpVFd
TLSH
T1F0A4E0367681C233D29302710BE6E7DAAA3E74B14776A4C337D4062D1EA1AE0D779357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5760	E143.tmp

Executes dropped EXE 1 IoCs

pid	Process
5760	E143.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_5c64b9df746af2e198c8bb662d45aa97_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E143.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 5760	1028	2026-07-21_5c64b9df746af2e198c8bb662d45aa97_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_5c64b9df746af2e198c8bb662d45aa97_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_5c64b9df746af2e198c8bb662d45aa97_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Users\Admin\AppData\Local\Temp\E143.tmp
  "C:\Users\Admin\AppData\Local\Temp\E143.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_5c64b9df746af2e198c8bb662d45aa97_elex_mafia_stealc_tofsee.exe 4FA3A5ABB9633AD5BDDC471D2612D8B48261DE1DF2F6A0B1D8D3B213FBD3E48FA50FB38682FA6077B9CDD0F8E9F61A6B16C710A2BCE48316BD377E8D7289C567
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5760

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E143.tmp

Path C:\Users\Admin\AppData\Local\Temp\E143.tmp
Size 476KB
SHA256 e9ae86284e3f9299baefc503a5ceefade0d9a40ac7497c98e6d3d3c376afaba1
MD5 e90e9306e34d5b16f7bfc4c038d4fbf5
SHA1 80f03c1fbc85bf4b92a111c297ddbcb322106efa
SHA512 8572e8c27fbce3bf2c9ef2d99ca1920fe833fee251d7fc9bacdc1c1a8fe2bfbd927b79f4d88410ad58c81faeae8b1f736d7dfbeebf1856c939025bcb2190314e
SSDEEP 12288:aO4rfItL8HRR+SEregbTOp43H4kG7K9wlsDpVFd:aO4rQtGRQHRS23Yt+9wlsDpVFd
TLSH
T1E4A4E12A76818133D69302714BE6DBD66B3EB4B10725A4C33BD4027D1FA5AE1E37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download