691cb74a046cf73713728bd6156b6af0b612cc34c0acefc99d08ff4a099e6048

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/04/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260422-ter6faay4k
SHA256 691cb74a046cf73713728bd6156b6af0b612cc34c0acefc99d08ff4a099e6048
MD5 90e17fbe12b2d35277f9d4b3fa70ca89
SHA1 8be5094657264fd024001e2a99d4ff8f031f9fdd
SHA512 a3f41d95f60a1e6b6889ea3a9e75264a370f308652cb66a8c9645fcda250e1afa98e71262690def7cd6b2c6d163c8733f9ec22c5a409573bd3fb836ef3b313a7
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYtA5z5+fWz1elagsxnVws8WU3yA/JUXOpAIHEir:Wq4w/ekieZgU66AFLz1eyN4djPEilx
TLSH
T18494E0217682C037E1A706344BE5CB6A693D7DA14B32A8C73BD42BAE5E706D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3540	5A8F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3540	5A8F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5A8F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 3540	2720	2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\5A8F.tmp
  "C:\Users\Admin\AppData\Local\Temp\5A8F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe 69CF9DCE1388DA9C849CB39764D92DD3FC18988D2049040CDE6BBAC85D8C8F080DBEC18AC3BE3B04E0D613DEA83345721366146D8A060D7E7B382F967D7D4FF3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3540

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5A8F.tmp

Path C:\Users\Admin\AppData\Local\Temp\5A8F.tmp
Size 414KB
SHA256 405e63b9c56bfe8adf8d72ea5477dce510dd02eaecd941de9690d0172cb8c6a1
MD5 b62b99a880a9771f186fc9771fa55d99
SHA1 6cfcab28518fd3212897afa549989a18372c0b08
SHA512 43de7bfb930fa7d2c6978d9adec42c6c75af25d2cbe9d0eee144cc4702bd37555106fc98dd0cfa47af1a6b8a8cb3f9dfa75637872ad7c40548e8fc352861962f
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYYMTGabmlO7zSNNuBxLQdUhEsuaUsfuj24lx:Wq4w/ekieZgU6VMTGBO7K2EehffujHlx
TLSH
T13194E0253582C037E2A705388BE5DB69653A7DB54B36A8C73BD02BAE5E342D1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2720-4-0x0000000001520000-0x00000000016CC000-memory.dmp

Download

memory/3540-5-0x0000000001660000-0x000000000180C000-memory.dmp