a5bd5bfb1e7b56b9cb9b4c170a1e675000bfd68fd4b181578fc6419e7f3cc0c7

Analysis

max time kernel
148s
max time network
145s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
21/07/2026, 17:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-21_823175dfbe603c1bc9be08032f90ea20_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260721-vla16sch35
SHA256 a5bd5bfb1e7b56b9cb9b4c170a1e675000bfd68fd4b181578fc6419e7f3cc0c7
MD5 823175dfbe603c1bc9be08032f90ea20
SHA1 a0be6528598de355088308f94920af63a3b42cf8
SHA512 7640d2b98412c2794a369710de7e8609dba71ac534884ce12afab837e6c845e7e41495b3ad03a72db210db3dab826461e549779980f70bc84682f7e72f02eb0e
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYtj5+j1brcVaRxtq+Zcv4fjFzBHdglx:Wq4w/ekieZgU6mj5+j18V2MQfhV9glx
TLSH
T1F094E0217686C037E2A716384BE5CB6A596E7D710B36A8C737D02BAE6E742C1C731347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3364	E601.tmp

Executes dropped EXE 1 IoCs

pid	Process
3364	E601.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-21_823175dfbe603c1bc9be08032f90ea20_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E601.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5088 wrote to memory of 3364	5088	2026-07-21_823175dfbe603c1bc9be08032f90ea20_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-21_823175dfbe603c1bc9be08032f90ea20_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-21_823175dfbe603c1bc9be08032f90ea20_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5088
- C:\Users\Admin\AppData\Local\Temp\E601.tmp
  "C:\Users\Admin\AppData\Local\Temp\E601.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-21_823175dfbe603c1bc9be08032f90ea20_elex_mafia_stealc_tofsee.exe 610410DD86D3932738AEF809E1D47A238A95CF8E0965109CB08ACF538D298F96EE371C3F210A4D34108DB304FB749C999163CCCE2FDEA567CCBABF012E1CBB85
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E601.tmp

Path C:\Users\Admin\AppData\Local\Temp\E601.tmp
Size 414KB
SHA256 9bd206916d4e248130953fa1cb541468c00508b18f9edcd0f5580323b4576bd0
MD5 8afcb90697bb87737354028759190735
SHA1 3a456f3b77b10b7e3d5577568cf24a9137bfcf25
SHA512 beb177c5bbd9dccd9b3d02b560a69d503b7581805431a0a90c2ae82024128ffc9fc14d654decd29b52618c02dd4df974a18cce583b6988d40f1c3afb30ca1b7f
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BY054aAFlkZo2GgtG/jpgRvHNZR9vlx:Wq4w/ekieZgU6FcFlkZZG0G/1gj3vlx
TLSH
T1A294E0213582C037E2A605394FE5DB6A69BE7DA14B32A4C73BD427AE5E742C1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download