3a79e7dd1342fd083b90fb6cb7193dbf03699a4c1317886605c7ef8803f6bf76

Analysis

max time kernel
149s
max time network
136s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260423-s9lrgagy6l
SHA256 3a79e7dd1342fd083b90fb6cb7193dbf03699a4c1317886605c7ef8803f6bf76
MD5 7586fe9dfefe00cfdc14a4ab96b8baac
SHA1 0205b03a47ddcbe5d8623dd79baf10846a074441
SHA512 0b1593b60d6bd338614243713abf6f284384b98fd1f0458cf660d8b52dc4c8a90be531e922431d27d1680672cd0dcc9da294a554fa147cfe4eb1e8602c83b96e
SSDEEP 12288:fd4x+ePixnXQjnvWmW6cKzCXwdbiavLwP:fd4x+ePixAjnWKriavL
TLSH
T17F94E0213646C037E1A616394AF4DBAA59397DB04B32A4C73BC42BAE5F742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2596	271B.tmp

Executes dropped EXE 1 IoCs

pid	Process
2596	271B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	271B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2268 wrote to memory of 2596	2268	2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2268
- C:\Users\Admin\AppData\Local\Temp\271B.tmp
  "C:\Users\Admin\AppData\Local\Temp\271B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe F1B60931478BF4EFAE5DCF5FA3294AEB227A0495F5B10051D3CC6D30C3B4E7659238FD069682E7DB93BD3A9508D9C6EB303DF2C07A5E5FC370C9E6EB050404F1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2596

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

271B.tmp

Path C:\Users\Admin\AppData\Local\Temp\271B.tmp
Size 435KB
SHA256 1d167e0708c0c186c6648d669d841a3126f36d9e0bfe563c69250f38bd33dce9
MD5 cbed29648a107111c73f5337b3d9ea78
SHA1 d3b78addb218cb89e16ab5b213628d06c387f5c5
SHA512 fe7e497444360bad9a191154a24aebc305917ceea179e9f3131e8fe9d0c4bf04b87896bfe061cada7c10cc85d562240686fe544a89bc6721e64aac110738942a
SSDEEP 12288:fd4x+ePixnXQjMC6GPoYpiqqkPSiPnXSv+9ZwP:fd4x+ePixAjIIpiqnjXN
TLSH
T1FB94E0203686C037E1A706384BE5CB6A5979BDA44732A4C777C42BAE6F746C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download