5e0af5afaea20186c944e5418d0bf4c8100fe1c960430ae1751e76f60bd2e702

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 08:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_3ded5a066c5d4be68e6893f02eacc7d1_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260727-kf2ltsab32
SHA256 5e0af5afaea20186c944e5418d0bf4c8100fe1c960430ae1751e76f60bd2e702
MD5 3ded5a066c5d4be68e6893f02eacc7d1
SHA1 e14bfb6d96bb351f892838e3228380f549b5a1cd
SHA512 6c39ebb35888b887ee657661f352f0257dcb0e9025535bd4f8e4ab08d2f62694374fe26fb5416834e619cbf2e2271c41dfff883ab4f532733317a6595798db9e
SSDEEP 6144:a9EyS4oMxIkjxcWqHtg88HRR2/RznnUaSjl7xzNW/SPffXEm46o8I7zZti9f4lsL:aO4rfItL8HRlndNSZ7K9wlsDpVFd
TLSH
T181A4E1367281C233D29302745BDAC7A6A63E3975172664C33BE8027D1F61AE1D77A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1236	5C10.tmp

Executes dropped EXE 1 IoCs

pid	Process
1236	5C10.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_3ded5a066c5d4be68e6893f02eacc7d1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C10.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3192 wrote to memory of 1236	3192	2026-07-27_3ded5a066c5d4be68e6893f02eacc7d1_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_3ded5a066c5d4be68e6893f02eacc7d1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_3ded5a066c5d4be68e6893f02eacc7d1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3192
- C:\Users\Admin\AppData\Local\Temp\5C10.tmp
  "C:\Users\Admin\AppData\Local\Temp\5C10.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_3ded5a066c5d4be68e6893f02eacc7d1_elex_mafia_stealc_tofsee.exe 530EBAAD497820D63C85ECF9E86354FEA513D36B24CB7655C9F19E480E3207596FBEB1D4E9819C079A7845AED0BA1F26DF208610A46CAFF1C35D290692A0FAA6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1236

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5C10.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C10.tmp
Size 476KB
SHA256 2912fafdf6d64c746b34e81d6dd6c0a05747bbd2dc1190b0e056f837de90af83
MD5 8172782ae400ae2cf4f1c11d45759658
SHA1 a2885720c8582a55bc7d47f7d80aaad98fcc2943
SHA512 7e08bfa42a9ef8351671e8316cc8d9bc5e957da7a0744532c21c3f984594b42ce098e3baf01b7ad83dfc5df186bed2afa82a00098c4d3c21db50be185e2f0e0f
SSDEEP 12288:aO4rfItL8HRmRwcDDLKVZC3gtA8PfizP1T7K9wlsDpVFd:aO4rQtGRm1XLKa36X4P1T+9wlsDpVFd
TLSH
T18DA4F13A7641C133D6A211345BE6DBA6B63E79B4032694C33BD4027E1F616E1D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download