f4ea7a64cacc3151fe0469a1198e0107db58e6e5d25e9d5ff73345a4945a2840

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 14:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_c5d843eb1da260864e6066bd2bea9c84_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260721-r2bqvsdj4v
SHA256 f4ea7a64cacc3151fe0469a1198e0107db58e6e5d25e9d5ff73345a4945a2840
MD5 c5d843eb1da260864e6066bd2bea9c84
SHA1 7592d29caf0bb618c4e28a9807df3a1cbe94cd82
SHA512 b58e720898e871341a31c3a65a80e951393cc9d4759dd64e739cc782a9a2555b10ce7bb0bbb33fb46becb4c7a3c14509d531abd03926608d8fcec970d3b42f2e
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStGKXKSpWnyy6gC9ohBAnEeonoxgk/vGe7n7b:Nb4bZudi79LWpMJBiEelDvGeH9S/A0a
TLSH
T1F8A4E0213591C037E2A702394BF5C7B5593A7DA19F6268CB3BA03B6D6EB02E1D634353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1184	53E3.tmp

Executes dropped EXE 1 IoCs

pid	Process
1184	53E3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_c5d843eb1da260864e6066bd2bea9c84_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53E3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4900 wrote to memory of 1184	4900	2026-07-21_c5d843eb1da260864e6066bd2bea9c84_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-21_c5d843eb1da260864e6066bd2bea9c84_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_c5d843eb1da260864e6066bd2bea9c84_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4900
- C:\Users\Admin\AppData\Local\Temp\53E3.tmp
  "C:\Users\Admin\AppData\Local\Temp\53E3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_c5d843eb1da260864e6066bd2bea9c84_elex_mafia_stealc_tofsee.exe 2CC615B78D08FCD97B438E15C219E47BD6BF3A959B66BEDDD36F556011DA456B7D6D7E96E033239E704A3F1868D4D0FA04A54CA8D7772E74D0AA4FBF80C5A10D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1184

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53E3.tmp

Path C:\Users\Admin\AppData\Local\Temp\53E3.tmp
Size 473KB
SHA256 a4b4eb0bff0137e503713729a6ad0580721abc9ff7e74760a011b1e4fc739968
MD5 69db68320115339661a19cb94b05ff5b
SHA1 e818d3fcd079514a8ca67481b4b280cac4b7d56a
SHA512 d2bd45b3a82549b294f3b35f49f1514e439c0b11f53b40bfc2b91c6ad22af8d1163fb7152da670062122c0a6d94a28e27debbe46faaf0eff5e17b65a77fa4a0b
SSDEEP 12288:Nb4bZudi79L8hcNj4yQhL4Jxsnfbw9VPWRQTKbqpvA0a:Nb4bcdkLiEj4lhSxsfbwqCm2I
TLSH
T172A4E0213682C036E29702354AE5C7B5657E7DA15F36A8C73BC037AD2EB06E2DA35707
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download