2878406f355f7ce31ea114cd6caf61d27a32d9386aa13353902194f2dff764c1

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 03:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260416-efcd2sav3t
SHA256 2878406f355f7ce31ea114cd6caf61d27a32d9386aa13353902194f2dff764c1
MD5 36a5b349cdccfc7e06f39bd68df3bb37
SHA1 f2a30e7cf87033285b424cdc7d09999f2488bf08
SHA512 0b1d62cc88cc7f0a9906b478a8970fb55af1173d52b0a4276a8259c5f5013ca256d542facc276eb6a5ea1e4e0d91589c0418a4bd756148547c5f15c303646a37
SSDEEP 12288:si4g+yU+0pAiv+jDQeZ+XTgWY/ApN1ETAEUlM0xUlvjosTdcG93Dn:si4gXn0pD+js4gkH4P1aT3lvjRhFJ
TLSH
T10AC4F1303192C033D6A715750BE5D7A5667E39B60726A8CF3BC02BAD6EA02D2D739347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
2268	487E.tmp
4252	2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	487E.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
2268	487E.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 3392 wrote to memory of 2268	3392	2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe	80
PID 2268 wrote to memory of 4252	2268	487E.tmp	81

C:\Users\Admin\AppData\Local\Temp\2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3392
- C:\Users\Admin\AppData\Local\Temp\487E.tmp
  "C:\Users\Admin\AppData\Local\Temp\487E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe 67A93B7FE5CD3081BDE3D96620A52CEA5C04A8F0C1190375462C6CE049202A8D9B608BC10DE60359920BF256D8B41F59EE2BAFFEFCFDAA7502C2808F6CD6F498
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:2268
- - C:\Users\Admin\AppData\Local\Temp\2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:4252

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-16_36a5b349cdccfc7e06f39bd68df3bb37_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

487E.tmp

Path C:\Users\Admin\AppData\Local\Temp\487E.tmp
Size 535KB
SHA256 86217eb8dec19741f4a3bca894abb469e07e25a460ba74204989e6e423ef562a
MD5 97afcd6e804cb8d72bcdad5db5dd3421
SHA1 f75601f28720686a8191d97ffffc1a3323c34c09
SHA512 6176fe28b59bf97bcd58843a90f20dc8a77199998676248579839c63f948200159cdf85d49ed8ede80b2c62aee74e0f52956bf4688fd66cda7644e99f622c036
SSDEEP 12288:si4g+yU+0pAiv+mfSWftmmZUE0i2ZPp5gbR8E6DzHWmTxUlvjosTdcG93Dn:si4gXn0pD+7m+EY9paR6v2BlvjRhFJ
TLSH
T1BDC4F1253686C037E2A715344BE5CB69657E3CB2072668CF77C42B692EB43C2DA3534B
MD5 SHA1 SHA512 SSDEEP TLSH