123e6900488d3934a6ce5db0c7a65ef5d22ba7138d5d26d3bc2757447926467f

Analysis

max time kernel
148s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260709-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260709-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
17/08/2026, 20:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-17_0487aa5373877dc281caef6c841d7d87_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260817-yy9xtade94
SHA256 123e6900488d3934a6ce5db0c7a65ef5d22ba7138d5d26d3bc2757447926467f
MD5 0487aa5373877dc281caef6c841d7d87
SHA1 578dea3895bfe6d1687c42cc2d69bd0fd6b5b550
SHA512 dcc77f0fd19fd84a296be0bda25bd214461f638d64665adaa7c19af9f7cda45972e353ddf0496ba89db8bb617384f3a3f0b262fa3b6485a71b32346fa94ae18c
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYSMdPi1Anap/WiU3G4rkXG+KoylDn5Y7xw9J:fd4x+ePixnXQjIUZ83G20GT5Y7xwP
TLSH
T11C94E0213586C037D2A306348BE1DAAA597E7DB10736A4C73BD02BAE9E746D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2884	5C10.tmp

Executes dropped EXE 1 IoCs

pid	Process
2884	5C10.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-17_0487aa5373877dc281caef6c841d7d87_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C10.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2212 wrote to memory of 2884	2212	2026-08-17_0487aa5373877dc281caef6c841d7d87_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-17_0487aa5373877dc281caef6c841d7d87_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-17_0487aa5373877dc281caef6c841d7d87_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2212
- C:\Users\Admin\AppData\Local\Temp\5C10.tmp
  "C:\Users\Admin\AppData\Local\Temp\5C10.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-17_0487aa5373877dc281caef6c841d7d87_elex_mafia_stealc_tofsee.exe 44A67649B814AEDFFA4D38620A24E4C1B34BFFEC0618806683CA179DC74917B6E5EFD9AFE37A25BFBBE50E39CC2601DDC4C92BA33031FEA3395D3F5890C8A1BA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2884

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5C10.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C10.tmp
Size 435KB
SHA256 008d920e5c118c7ff96a2d818280db57fea8386c4069b7a07e434bc5ee8c783d
MD5 cecfb7e0797c48edde6f294bfd3bb307
SHA1 733d3594dc6e54c39782afa0fb971eec9e68449a
SHA512 1665a67a96db4a11e9cf173fde1de2782bf97d4813850fa7220161101ea04b2abba7392a165a4524d19395f317c6496ad68a912ff628c9382ebd8401a383cdc4
SSDEEP 12288:fd4x+ePixnXQjo70k4YAsMwHK9IGwLQ2y9kFwP:fd4x+ePixAjo7GYAZTwkDkF
TLSH
T12594E0343586C037E29615348BF5CBA9153A7DA44B36A8C73BD42BAE6E742C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download