21779bd03a103677faa3399d3be6af603aad5c5c3c9648f27d4830411aedaeee

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/04/2026, 02:54

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_ab35c264538e1d843b2e4d723d2c0e42_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260418-deebksfv2w
SHA256 21779bd03a103677faa3399d3be6af603aad5c5c3c9648f27d4830411aedaeee
MD5 ab35c264538e1d843b2e4d723d2c0e42
SHA1 4c3dfdf6fdb4d6a464febe1d794477b87da155ca
SHA512 24e202e3597a7614bc1646f05bd4fda6c7047cfce8121ba137628221fd1b56310a41973c16a9d4c4bcbba98468aee3cf35d946c46bd58e6472120f554453168d
SSDEEP 12288:Wq4w/ekieZgU69OA9EJDBve7ppNU0MvqfJ3lx:Wq4w/ekieH69OA9EJEpzMSfJ3r
TLSH
T18594E0217486C033E5A716348AE5DBBA193EBD614B32A4C73BD41BAD2E746D1DB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3228	F2DC.tmp

Executes dropped EXE 1 IoCs

pid	Process
3228	F2DC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_ab35c264538e1d843b2e4d723d2c0e42_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F2DC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2084 wrote to memory of 3228	2084	2026-04-18_ab35c264538e1d843b2e4d723d2c0e42_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-18_ab35c264538e1d843b2e4d723d2c0e42_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_ab35c264538e1d843b2e4d723d2c0e42_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2084
- C:\Users\Admin\AppData\Local\Temp\F2DC.tmp
  "C:\Users\Admin\AppData\Local\Temp\F2DC.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-18_ab35c264538e1d843b2e4d723d2c0e42_elex_mafia_stealc_tofsee.exe C17C6D72BE65B3E05591587F60B1D4632B4F541666B29D80DBD2F45A602FC01096D90F49C0472C40608A71312CAE46FC9248A63F07F995B355E5E607163AF5A9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3228

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F2DC.tmp

Path C:\Users\Admin\AppData\Local\Temp\F2DC.tmp
Size 414KB
SHA256 7097d2bd27e0d17eb853a4408c9bbaf1459893f84d1421557ba7bebebd5c0568
MD5 f69b8d41ff5ea4eadacf9f9ebbeeb652
SHA1 4f392fc6afd8667be6d37b2e1e8574d697612bba
SHA512 e4ee28091e2accfa0bc5d7525263a158f16b7c6a01573f1c0d43e8ca8715447bc5b93c104727fd140e65f40732a9d74b4edc3e05ede50712dc6ce72456a14e8a
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYQg74YDj/RJsimFWKYrdbFlLnj+wlx:Wq4w/ekieZgU6v+vH/RJsicY5bXn9lx
TLSH
T14A94DF213686C037E16705344BE5CBBA197A7D644B36A8C737C42BAE6E702D2E73534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download