3c1855501b013c08dcb5db99f06336dd76ff0faca9793f012331f0a0fefec062

Analysis

max time kernel
148s
max time network
115s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
03/08/2026, 09:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-03_853405107791cee91f80c800f4e6187d_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260803-k2vqeasfnf
SHA256 3c1855501b013c08dcb5db99f06336dd76ff0faca9793f012331f0a0fefec062
MD5 853405107791cee91f80c800f4e6187d
SHA1 2244e06818841786d9c6b0fb8d2aed57da365144
SHA512 861057615779f9d2668407173fcc134d2138f04fa2377e93f0f7318f4b2e5e12229572c111fb78899a4675794863c5b7d9bdfdbd1af1ed61556cd47c2d4ad135
SSDEEP 12288:Ci4g+yU+0pAiv+aZvfDs0euImptYNA7QDwwB:Ci4gXn0pD+yXDsrcptYN
TLSH
T1E594F1347591C037E2AB19384BF4C765567E7AA1472668CB3BD00BAE6E603D2DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5972	18BE.tmp

Executes dropped EXE 1 IoCs

pid	Process
5972	18BE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-03_853405107791cee91f80c800f4e6187d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	18BE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2960 wrote to memory of 5972	2960	2026-08-03_853405107791cee91f80c800f4e6187d_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-03_853405107791cee91f80c800f4e6187d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-03_853405107791cee91f80c800f4e6187d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2960
- C:\Users\Admin\AppData\Local\Temp\18BE.tmp
  "C:\Users\Admin\AppData\Local\Temp\18BE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-03_853405107791cee91f80c800f4e6187d_elex_mafia_stealc_tofsee.exe 24B6CF8BFC53CB534DEB763E627E5FF5D07753623F1C4ED50117AD4CEAB26FB2C0D060F3C5B69B2922BD8398D0E4147E31468194DD4E24233E342F9DFA9F7D48
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

18BE.tmp

Path C:\Users\Admin\AppData\Local\Temp\18BE.tmp
Size 433KB
SHA256 0becff20f86ab9cace8071b972b7fa9ce9eebb189c597422a536cfb07a9512b7
MD5 1554db1452271db83f6189ea0602f4d5
SHA1 d832797fb276b4c39bef80659885d2c90b586e17
SHA512 927635c86bf66c978132530d8d19171e2f9174b470056ebb23b439ed07c315fb28e4d8670a73bc786cce59cd1a9aa814971ea06c5eb2752ec3a76ea87f7fab0d
SSDEEP 12288:Ci4g+yU+0pAiv+TJ08/4v5eVzYR1ecjkTjzlhF:Ci4gXn0pD+TN/7VzYR1LM
TLSH
T15494F1213182C033D19719784BF5D7A6667E7A70072668CB3BD41A6E6FA43E2E73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download