eca2ad3e54803eca3cdc435d196e36bed5aa21883888f40f8485bcefdab75c9b

Analysis

max time kernel
150s
max time network
126s
platform
windows11-ltsc_2024_x64
resource
win11ltsc2024-20260710-en
resource tags

arch:x64arch:x86image:win11ltsc2024-20260710-enlocale:en-usos:windows11-ltsc_2024-x64systemwindows
submitted
19/08/2026, 04:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260819-e6jaaayvbt
SHA256 eca2ad3e54803eca3cdc435d196e36bed5aa21883888f40f8485bcefdab75c9b
MD5 bc456041feaabfc0186054f0fd980997
SHA1 f1bcd746afb63582f033d8cab4483e305a5b3437
SHA512 078cf89670039f853778fd71d3149bee48e822ea795e862ac838b11b0d154400339209191fb2cd93dc0098612c5df5c38d0f6fe6659dae1aa753241aff69d113
SSDEEP 12288:Nb4bZudi79LejDnzssxfhHy26GrVZN28TdgyohA0a:Nb4bcdkLej7gEZHy21928Jgyoo
TLSH
T1CAA4DF253581C037E29B06384AA5D7B5663E7DA15F3168C73BD07B6E2EB02E1EA34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6000	69AD.tmp

Executes dropped EXE 1 IoCs

pid	Process
6000	69AD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	69AD.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3640 wrote to memory of 6000	3640	2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe	89

C:\Users\Admin\AppData\Local\Temp\2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3640
- C:\Users\Admin\AppData\Local\Temp\69AD.tmp
  "C:\Users\Admin\AppData\Local\Temp\69AD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-08-19_bc456041feaabfc0186054f0fd980997_elex_mafia_stealc_tofsee.exe 5AB48C3409DEF00B606ADC532F9111DEA75CC6639C16F7E60D8F15DEA5279706C936834B8CD910CCEEA916ED7C9A67F36ED17FE37C77FF65B4684CD7F93259AE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6000

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

69AD.tmp

Path C:\Users\Admin\AppData\Local\Temp\69AD.tmp
Size 473KB
SHA256 6c8bb422aa1fc27053bb8d5839875ed76ffae5221362a0951fd7a9b169861303
MD5 e874cf4fb3ce3b8217486a8f3cce4021
SHA1 2bcad3c673aa6b43c562910c944e3ca66bfec3b1
SHA512 a1a80364d4e79fefafc7d3b1cc86fa7d937bd6bcdc72c94c7fbbbc16b47763bd87f93dc8de7c8225594bfd89004792501ddeda0b7304b2ae9c1ed8c66423e23b
SSDEEP 12288:Nb4bZudi79LdLR1srwuiXxHxStnQm8xcmA0a:Nb4bcdkLhXsrwuiXxRiQmmcl
TLSH
T170A4E0207681C037E1A716350AE5C7F6A53E7CA19F6268C73B943B6D6EB02E1DA31317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download