5c5725e098f14b0adc4a2e78ab83a5fd0901206fb529215383dfd98851221fde

Analysis

max time kernel
149s
max time network
115s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 14:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_5d561de5c717439c8eb204b820304ed6_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260423-rdn2aaev3j
SHA256 5c5725e098f14b0adc4a2e78ab83a5fd0901206fb529215383dfd98851221fde
MD5 5d561de5c717439c8eb204b820304ed6
SHA1 0755a8539ae3b12c4adfaaf4a2e74059ffa8eb91
SHA512 18767329af892c5ae2f6ed50801f7a66070c93135abd6157d27367e9a61e0f1576cacf9deab4a3a719a042fad202f39a95675e86d5a686c2a7768ef5315b733d
SSDEEP 12288:Z594+AcL4tBekiuKzErDl4Yi+DPuUkZecoh3d+e/l:BL4tBekiuVrpPM3i3d+y
TLSH
T12294F1313582C033E2A715344BF5DB6A597A79B20B16A8C73B940B7D5FA42D2EB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4692	37E4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4692	37E4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_5d561de5c717439c8eb204b820304ed6_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	37E4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5116 wrote to memory of 4692	5116	2026-04-23_5d561de5c717439c8eb204b820304ed6_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-23_5d561de5c717439c8eb204b820304ed6_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_5d561de5c717439c8eb204b820304ed6_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5116
- C:\Users\Admin\AppData\Local\Temp\37E4.tmp
  "C:\Users\Admin\AppData\Local\Temp\37E4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_5d561de5c717439c8eb204b820304ed6_elex_mafia_stealc_tofsee.exe 0A084E422D868AE63821C2A5044D76BFEBE558725C2B778616047263280277007CC5A67A54BF1FE61201211222C8B5371F8B2913AF1D0B00B22C6ECD0D399804
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4692

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

37E4.tmp

Path C:\Users\Admin\AppData\Local\Temp\37E4.tmp
Size 428KB
SHA256 9ed007dc40cb320483bf5b7521bd60e497c67fd113ef52286fd80b8258ce54ce
MD5 ed2e0033cd18bdab4f68a590015fface
SHA1 101b4400e5b7fb7276e6df84f5254c1db38df9ea
SHA512 79befcf5d832ca8cb3d7b2c4c557e799caf44da3b29f796e467ebd36780253a747ae5c288ee850009fb257e7056421d43508caa51458baf41f2e33662e2cbacd
SSDEEP 12288:Z594+AcL4tBekiuKzEr5hoO8QX8gD9I32o17Y7ffw8l:BL4tBekiuVr518QXvm32o17iXw8
TLSH
T12C94F1353182C033E2A715388BF1DB66597E7AB21B1AA8CB3BD05B6D5F606D1E630347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download