059819001c52c2c5f87b4742355d7be66954ea96bce846140e7a1564e3af7f93

Analysis

max time kernel
148s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
11/08/2026, 03:50

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-11_11ff60dcf070561b81b23bc2b471f16c_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260811-ed8pgavgld
SHA256 059819001c52c2c5f87b4742355d7be66954ea96bce846140e7a1564e3af7f93
MD5 11ff60dcf070561b81b23bc2b471f16c
SHA1 0237ecc52b27fff494be391b2c3382ba27350253
SHA512 91a8eb5611aac049549b18619b470a21c1dcd9554331e9859b9584035b28da363485737006d92d1c4cdd1fc27166e85a7f872671206a1ca6d49db934bd4be4f3
SSDEEP 12288:iA4g7yYea4GZo2ulMUeWqMtpH3f9u5oe:iA4g7yYea432ulVFRfHv9wo
TLSH
T18594E0203591C037E2A706354BF5CB6A557EBDA54B26A8CB3BC02B6E6E702D2D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

discovery

Malware Config

Signatures

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2712	1396	WerFault.exe	87

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-11_11ff60dcf070561b81b23bc2b471f16c_elex_mafia_stealc_tofsee.exe

C:\Users\Admin\AppData\Local\Temp\2026-08-11_11ff60dcf070561b81b23bc2b471f16c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-11_11ff60dcf070561b81b23bc2b471f16c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
PID:1396
- C:\Windows\SysWOW64\WerFault.exe
  C:\Windows\SysWOW64\WerFault.exe -u -p 1396 -s 656
  2⤵
  - Program crash
  PID:2712

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 1396 -ip 1396
1⤵
PID:2076

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads