1ea947ab46357b5c4db371be4c182369a0767b2e5e8156de199c3a2bab3be50a

Analysis

max time kernel
149s
max time network
138s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260423-qerm5aev3w
SHA256 1ea947ab46357b5c4db371be4c182369a0767b2e5e8156de199c3a2bab3be50a
MD5 2705bc5a47e5ff77c08cccc3d8749802
SHA1 db2245ff71bb68ffd8a0c89f7d45df42cb639e8f
SHA512 955173f96af4d94a3196d6e913413451ee3b08be249f4fdf3c9fd4e0cf1d80bc919895f7fbb2915ea0f7d94b6b74211c8b74964d5d5ecc5908b8cbcf111b708a
SSDEEP 12288:Ci4g+yU+0pAiv+f41/h949y5IBt4kb/gT98AdhRwhKn:Ci4gXn0pD+fw/X49yoi6/FUhGY
TLSH
T11894F0313552C033E1A705344FE6CB56667E79A54B26A8CB3BD40BAE2E603D2D73930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2876	1807.tmp

Executes dropped EXE 1 IoCs

pid	Process
2876	1807.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1807.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2876	3352	2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\1807.tmp
  "C:\Users\Admin\AppData\Local\Temp\1807.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe 7DC69C3B48A61C7313C998C20C4F0123274C100E344607131E7B6D9E472D7F2082D240509BF6EDFE68DE1CF8425BC59F692C428B9EF0564CF83E052021586192
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1807.tmp

Path C:\Users\Admin\AppData\Local\Temp\1807.tmp
Size 433KB
SHA256 3f2e1416c54e99dc81cc484eb6656d77f4d7dab555be916577dc7e9911094837
MD5 8b3b409a64962a65129545e19bd010b9
SHA1 6cccb515eaefa20e0899c24a025da30c1d01d52c
SHA512 1e3cde1f2c72c0cd8b09445364869b2ef602702fa83caca9a8df8f88ab1117ecd677894b5fa50bb80eda9a4cfea5c73e7331b2aefde0c7943d5fa080c6cba22a
SSDEEP 12288:Ci4g+yU+0pAiv+qcmLq41jTDEW9tHmJVTr0YUGj+n:Ci4gXn0pD+qikjTDztHmJhJtjO
TLSH
T19E94F1213482C037E1A71A314BF5DB65667E79B50B2664CB3BD40BAE6E603D1E73834B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download