554545f746fcd8c02a1ba6407d8b1bf583deca20fe9f2c87fe62f284f0189cc3

Analysis

max time kernel
148s
max time network
134s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
28/07/2026, 02:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-28_37cc5d6599a94ac79b1872a01a161fa7_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260728-cverlsxsdw
SHA256 554545f746fcd8c02a1ba6407d8b1bf583deca20fe9f2c87fe62f284f0189cc3
MD5 37cc5d6599a94ac79b1872a01a161fa7
SHA1 27c7230d3a08fe5bdc9ba134ba82777794215fc2
SHA512 b9d62ae4d839af1a5d7cbd6a4dee4aa23825333e6f15e1b1d28508599ec90fda7d6acb6c848104b6921b51fa7980da7153ff93c76e8233d7afd1313808845662
SSDEEP 12288:fd4x+ePixnXQjjLadzCXARkNdvBGJ+p5UwP:fd4x+ePixAjjXQRkNdvor
TLSH
T1B794E0317282C037E1E619344BE5CABA596D7DA40B31A4C73BD42BAE5E742D2D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5776	2987.tmp

Executes dropped EXE 1 IoCs

pid	Process
5776	2987.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-28_37cc5d6599a94ac79b1872a01a161fa7_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2987.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1532 wrote to memory of 5776	1532	2026-07-28_37cc5d6599a94ac79b1872a01a161fa7_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-07-28_37cc5d6599a94ac79b1872a01a161fa7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-28_37cc5d6599a94ac79b1872a01a161fa7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1532
- C:\Users\Admin\AppData\Local\Temp\2987.tmp
  "C:\Users\Admin\AppData\Local\Temp\2987.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-28_37cc5d6599a94ac79b1872a01a161fa7_elex_mafia_stealc_tofsee.exe 1DA4AF8087FB06D287CDC0765074C18434F7FB56D7476B5B238CF829F364F8A969BBA33D9E8B19E01A456EDA49EA5B402099675C62308E5346943C62725E2DC9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5776

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2987.tmp

Path C:\Users\Admin\AppData\Local\Temp\2987.tmp
Size 435KB
SHA256 f7b459d7f9fb1620b5dd4a8a16d3af537a713f13abb35a02a84a979d2a19abd0
MD5 ca980e67a72898ddc210098777a405ae
SHA1 f6aa42f4e61c3d2251dae79bcfa16a68cd37d847
SHA512 934166909800d193c43b4979964195a2c8aaf21ea26254c0167178fb4ef7b36a956517090dcc98847dec8d1a80f45812d3531bf2e4b90cfc93ad6affee151603
SSDEEP 12288:fd4x+ePixnXQj16EydGU/Q5DfRrDZT/wP:fd4x+ePixAj16EydGUiZrt/
TLSH
T1C894E0217586C037E1A706344BE1DB7A692A7DB11B32A4C737C43BAA6F746D2D63034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download