e43b682e739c798ded5aa9ae9c35e3169eb529ca849b09a051978537f50cd7fc

Analysis

max time kernel
149s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260423-sycdnaht21
SHA256 e43b682e739c798ded5aa9ae9c35e3169eb529ca849b09a051978537f50cd7fc
MD5 2efe27711f96c3ae2ddbaa5c58c25b87
SHA1 aa6fbe6bc655d8ff0de6e788aa3decd11d0f21b6
SHA512 9201ec89076ac080528e61e03d062f33730201af379220f79f6aa40132c5546f926c86a08153131001978cef6431f7c978ea27ab2b16ed4691c90ae0ef552ba3
SSDEEP 12288:bO4rfItL8HABR9MaVDPj4AcwjsIxmpe575UO:bO4rQtGABXVDr4APsIE85VUO
TLSH
T156A4F13A7241C133D29302755BE6DBAAAA3E35740762A4C777C8027D1F616E2D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4208	5232.tmp

Executes dropped EXE 1 IoCs

pid	Process
4208	5232.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5232.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2192 wrote to memory of 4208	2192	2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2192
- C:\Users\Admin\AppData\Local\Temp\5232.tmp
  "C:\Users\Admin\AppData\Local\Temp\5232.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe A77D6B46EEC64754D74FD578AD0767E8089C6AEFADE4DAD0CA02CD05650B350F8D70D5CC622F67856476BEAB43522FE7692639ABD64166D60FE21C3E961448F4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4208

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5232.tmp

Path C:\Users\Admin\AppData\Local\Temp\5232.tmp
Size 479KB
SHA256 831a6a70815d4c7f58cb98c9942617fb2b24d8e9ad19d4eead32bf51a0c478e7
MD5 ebfe3a467f91f234089f45f4df3bc041
SHA1 cc07aab1cdc63287394751ee01842a4394eb952e
SHA512 0a53b86b927f248ff9cba999b347aece49afb39d40221b4f61b75f6b191822eb22fac37e5f7cfe369bee2a6dac49b48a82659f40dada52ec4ed19b971ba9f0e2
SSDEEP 12288:bO4rfItL8HAmOUwpPpFWO4F7De3YwZd8flWOHZGzr75UO:bO4rQtGARUwPYFneYwDGLZqrVUO
TLSH
T111A4F12A7681C133D29302711FEAD79AAA3E75B10326A4C33BD4076D1F656E1E37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2192-4-0x0000000000C10000-0x0000000000C74000-memory.dmp

Download

memory/4208-5-0x0000000000900000-0x0000000000964000-memory.dmp