5cdc6c27bcdafcdf935d06c9042dee78e8440cf4a53ec50d050f2486c074bfa0

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260727-rd6lbstgld
SHA256 5cdc6c27bcdafcdf935d06c9042dee78e8440cf4a53ec50d050f2486c074bfa0
MD5 e7adea26bae94f4b49c6335f19402ac5
SHA1 5d0c1578824df71bfd557c456a2471ece21f1396
SHA512 ccd7275de67c73f6b56e8974ed5e35cc2f38edb3510dcead0390b5148ff7cbb4e60507fa836c8d11d9f3d8295f9ca410bf5ba1f5249ea2329bab7ec45d25efc8
SSDEEP 12288:Nb4bZudi79LEPEzLKhQcmJCzcK/wXrxHDJwxj5UA:Nb4bcdkLZLJMzE1wd
TLSH
T18CA4F1243591C037D2A715344FE6DB65A67E39A10B2268C737D42BAD6EB02E2EB31353
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1188	B00C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1188	B00C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B00C.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2500 wrote to memory of 1188	2500	2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2500
- C:\Users\Admin\AppData\Local\Temp\B00C.tmp
  "C:\Users\Admin\AppData\Local\Temp\B00C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_e7adea26bae94f4b49c6335f19402ac5_elex_mafia_stealc_tofsee.exe 2CEA81CD748350DBE187A5962BF8C4773B33D4DF3051E7E4E7DD2A5A97577135C31EC68F8ECDA6F478536D655D9CE32E31D462E843AE0944969186D2C56274E6
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B00C.tmp

Path C:\Users\Admin\AppData\Local\Temp\B00C.tmp
Size 444KB
SHA256 3ba13d5b3c3de2e2b424124ddb114e08caa4fb04af498cdb48eba32b8508b52a
MD5 6204db0f65cfbe540dd2b6e2f7963311
SHA1 33f6068edace8f2365545b37b10fe62c2496a93c
SHA512 17c118c31717c90dd8fbcaf3c45256110766339ffc7498fa92bdf6f0513cacf1cde644af5f688393baec23154f36befdc8e368f1eb3e2709c7a649bdd1a49e7b
SSDEEP 12288:Nb4bZudi79LunYBZPDwJJuizbexkyKGdzbKHA:Nb4bcdkLuaLmz6xkyKp
TLSH
T12BA4F1253582C037E29305350FE9C7B56A7E39A15B21B8C737946BAE6EB42E2D730353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download