d47dfb44a87b2709c9e45c9175fb6f5fe2bc8ce57c8fd42af5233d7eec77c449

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/04/2026, 06:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-16_e8cbfbe61b0e48889513506eb993d811_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260416-halmbagy3l
SHA256 d47dfb44a87b2709c9e45c9175fb6f5fe2bc8ce57c8fd42af5233d7eec77c449
MD5 e8cbfbe61b0e48889513506eb993d811
SHA1 ea8a2fce33c45eb4593c0f110e6058edd61a5ad9
SHA512 280016f6f0f9c99ebf657ba64d2a590f967125deaca5092619f92a8d0692a403b770073902fc41ec697e678b946bbb50a11a7cddd3639c8a86b5e79df374ab0e
SSDEEP 12288:Nb4bZudi79LXwooOCm0tjbd6fCgW88mA:Nb4bcdkLX5oP3dcjW8
TLSH
T101A4E1203582C037E29716384BE5C776A53E79B14B22A8C73BD46BAE1E743E1E634357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2800	DD60.tmp

Executes dropped EXE 1 IoCs

pid	Process
2800	DD60.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-16_e8cbfbe61b0e48889513506eb993d811_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DD60.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3672 wrote to memory of 2800	3672	2026-04-16_e8cbfbe61b0e48889513506eb993d811_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-16_e8cbfbe61b0e48889513506eb993d811_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-16_e8cbfbe61b0e48889513506eb993d811_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672
- C:\Users\Admin\AppData\Local\Temp\DD60.tmp
  "C:\Users\Admin\AppData\Local\Temp\DD60.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-16_e8cbfbe61b0e48889513506eb993d811_elex_mafia_stealc_tofsee.exe 1CAD7DF2E3C0F21E1A061C5A91771956FA864B4310543AFD4F9AE4ABC9934517E1E07E8B5E0EB330320EF98DE44809ECA4B1D4AF2D7B666A9D17ECE10DC3CBAC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DD60.tmp

Path C:\Users\Admin\AppData\Local\Temp\DD60.tmp
Size 444KB
SHA256 c8533b129ff4ca219df9d715d0541b225181c196d98beeb16be0504edf44b517
MD5 6b9b58389ce41dfeb69c0da105422113
SHA1 58f919d5c43ea9d1610ff5c5c661866aafa44466
SHA512 6b93b4472e7ba8ee00a8d6065ffcd0a183b98cb7577e4b188a1cbb40ef21a3ab0d183d99c3056f27cdce1210ab06f48b5f9e96b2add377706db6e77797814cc0
SSDEEP 12288:Nb4bZudi79LwOtHIYpsBy7kipb6ZGZ/lvfOckA:Nb4bcdkLv7k+WUxF
TLSH
T14DA4E1243582C037D2A715340FF6D776697E79A10B2268C73BD42BAE2EB02E2D635357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2800-5-0x0000000001530000-0x00000000016DC000-memory.dmp

Download

memory/3672-4-0x0000000001340000-0x00000000014EC000-memory.dmp