eb5805f957446f650d7841aec5acce8e60b76d0b4d678655bc2e2cd10240bec3

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
31/07/2026, 14:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-07-31_7fa9065b824b24ffac61c2ab2ebda641_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260731-rh9hsawsat
SHA256 eb5805f957446f650d7841aec5acce8e60b76d0b4d678655bc2e2cd10240bec3
MD5 7fa9065b824b24ffac61c2ab2ebda641
SHA1 1d9e212b44ecc80a98e2f672eec10faee58fc6b0
SHA512 6907155cc2a250042965e663278a68d5fae5a042a9dea683c202498c439edfcf5d1315d3c949384f48f648b319b2c751fbe69057bdb01ea46a79a3bf6e05a633
SSDEEP 12288:fd4x+ePixnXQjeIAv2ZgD8y11lpiTBmqyyUxFwP:fd4x+ePixAjQ2Z06sqy1F
TLSH
T1CD94E0213186C037E1E605344AE5CB6A597EBEB04B72A4C777D42BBA6E342D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3544	5F0E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3544	5F0E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-07-31_7fa9065b824b24ffac61c2ab2ebda641_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5F0E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4628 wrote to memory of 3544	4628	2026-07-31_7fa9065b824b24ffac61c2ab2ebda641_elex_mafia_stealc_tofsee.exe	88

C:\Users\Admin\AppData\Local\Temp\2026-07-31_7fa9065b824b24ffac61c2ab2ebda641_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-07-31_7fa9065b824b24ffac61c2ab2ebda641_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Users\Admin\AppData\Local\Temp\5F0E.tmp
  "C:\Users\Admin\AppData\Local\Temp\5F0E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-07-31_7fa9065b824b24ffac61c2ab2ebda641_elex_mafia_stealc_tofsee.exe 7AA647F44C1F381F7EEEE7D2CA2D781AD0CF86F436846D791A84331E0452FFA6AD9915D62208DB5E2EA7AC2BD4D0494539ACAD6F1C5F9EF6BA479098ED421C34
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3544

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5F0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\5F0E.tmp
Size 435KB
SHA256 7864f0c16e4a73bfa4b85377e500d728d0f3d44ede8fb7aa6508417475c0931c
MD5 eb265c7ea1a86c6257b7c56103011012
SHA1 f1424af555b9c8964774a8bfec754d69854a2c89
SHA512 ec510100f1913481028f85abf5a43459d2c70ae32b1d86a4e6974da04ba0075a111116dd6161b317297ede36f3fc3a8cc4dbb0b98710caaa58d12884807fda18
SSDEEP 12288:fd4x+ePixnXQjXL5isYSVLocZ08bwt3fGsawP:fd4x+ePixAjliXUG8APGsa
TLSH
T15C94E0213586C037E1A216358AF5CB6A59397D744B32B4C73BD43BAA6F602D1EB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download