ed5e5a9482125e723455454760cad3150dc6c8eaf422a4d3df06c93e65fa27ca

Analysis

max time kernel
150s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
16/08/2026, 12:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-16_f70f1fd568c510597d20c43847fba73b_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260816-pmc92adc23
SHA256 ed5e5a9482125e723455454760cad3150dc6c8eaf422a4d3df06c93e65fa27ca
MD5 f70f1fd568c510597d20c43847fba73b
SHA1 980427a68b06db39d10fd661014f13262a6557ea
SHA512 4401ae0fc1bbfa849056637cde1c52a96bc199cae4134a32ad4b2719c54fc9709892a3d04a80991c26cf888acda5e03c1b674e8367da795e172888a18f154fa3
SSDEEP 12288:Ci4g+yU+0pAiv+TC6ERS8QsPtR7XW6Jeutv6dn:Ci4gXn0pD+u6f01R7mFu56F
TLSH
T19494F0203092C033D29716754BFACB66167E7AA14726B8CB7BC40BBA6F606D1E735347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5232	5C5F.tmp

Executes dropped EXE 1 IoCs

pid	Process
5232	5C5F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-16_f70f1fd568c510597d20c43847fba73b_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C5F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 5232	4300	2026-08-16_f70f1fd568c510597d20c43847fba73b_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-16_f70f1fd568c510597d20c43847fba73b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-16_f70f1fd568c510597d20c43847fba73b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\5C5F.tmp
  "C:\Users\Admin\AppData\Local\Temp\5C5F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-16_f70f1fd568c510597d20c43847fba73b_elex_mafia_stealc_tofsee.exe 300E26C15B35B3893363F0B2D9F06D6244381218FA62D73225A96051BA8A55D724BD1FE0BC1B0FEDC593E054DC39A6E71EC8043B678B1C516FBEC8D489ECDC7C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5232

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5C5F.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C5F.tmp
Size 433KB
SHA256 c73e38bf1604c9e81901d98b7fcd040b62505daa397bab259f68591ff928950e
MD5 8612f0cb0a5db5994b6e056dbd333350
SHA1 006e95c62abcd8ee3de7eb88597433e4108d7aef
SHA512 bb47a2580edcc9cf9549b1a542e6f08e7a91733d19ea55e5344fd6a3e8f3b9ae84beaab76520dd0af8d716dce0736914291e0d81c6414203ebd6368015b1ed6c
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtv964T5nnJFKt8Ry4Hq7zcAiNezon:Ci4g+yU+0pAiv+64hLKcK7zcAiZn
TLSH
T1EB94E0303582C033E2E715344BF1DBAA19BE79A54B2568CB3BD41B6E2FA42D1D634397
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download