5ca4b03363d334bee6f2fdf698849ee1973c1e23743c02c46af37514ea2ddd2d

Analysis

max time kernel
148s
max time network
135s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
27/07/2026, 14:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-27_bf66119741484dd20f59a01e57ea132f_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260727-rlahvsvsgx
SHA256 5ca4b03363d334bee6f2fdf698849ee1973c1e23743c02c46af37514ea2ddd2d
MD5 bf66119741484dd20f59a01e57ea132f
SHA1 acd45f511ecbf66e6dd580341df8616f17cd063a
SHA512 5474b61dc2fddbfb086bf646712205cc1babbb3a850a1c8f490477396c5cb8eb4a26f2acf811282c7e2fa43d938b407f4c7494f9795ae358b3b120219256063a
SSDEEP 12288:Z594+AcL4tBekiuKzEr9jbYxQCtEOXdlmvd9W0RT9aueW3zSll:BL4tBekiuVrRwVm5gWml
TLSH
T19694F1313492C037D2AB15344BF9CB6625BE79B10B26A4C73BD81B796FA06E1D63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
904	1013.tmp

Executes dropped EXE 1 IoCs

pid	Process
904	1013.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-27_bf66119741484dd20f59a01e57ea132f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1013.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 904	2592	2026-07-27_bf66119741484dd20f59a01e57ea132f_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-27_bf66119741484dd20f59a01e57ea132f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-27_bf66119741484dd20f59a01e57ea132f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\1013.tmp
  "C:\Users\Admin\AppData\Local\Temp\1013.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-27_bf66119741484dd20f59a01e57ea132f_elex_mafia_stealc_tofsee.exe E07A3FD33BA1E99E5C9E7A9744206B9D83119EAFD9FCF482E581A0E8633DE3668AE389C1C0238D8E84F9932342C634BAA30D920A50AD8461F999F36EF36EBF59
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:904

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1013.tmp

Path C:\Users\Admin\AppData\Local\Temp\1013.tmp
Size 428KB
SHA256 54d4bfbc9970ad9fa5e0cf62c9fae56823d3f2444aacd717899b0870f0408aed
MD5 950b6364af4220d0d9b5449fb64158e4
SHA1 902419b8af371667b67f673972b5d699ed87c165
SHA512 a087e796dad6dfebc3a720c28e7804fd46bd965eb3052c551f75c0fe267bff12c989b23a295887ea0b5aac38bc87180a9854daf9b54b03bb2b8691c3c4e7a035
SSDEEP 12288:Z594+AcL4tBekiuKzEr9itGgGoLwBanhMSKspebl:BL4tBekiuVr9itEzDXspg
TLSH
T14C94F1313586C037D2A716344BF5CB6A5A3E3AA24B22A4D73BD01BBC5FA42D1E634357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download