9824ef789a0c27bb0ad8cfc09b02f0150062a63d0b289342bf7ad834fd04bf00

Analysis

max time kernel
149s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260423-t42feaa17x
SHA256 9824ef789a0c27bb0ad8cfc09b02f0150062a63d0b289342bf7ad834fd04bf00
MD5 08255f2112232890f9e74cbf6a520972
SHA1 a31088fdf5ff2f226a3f1c0175d0833849b3113b
SHA512 31f3ff121fef1a982a27caa4000fe9e586769ae81f925792f507dc973fe2e1b9a8154c422dda43e52fe4676f724bc8d47861fed4e8e39c26fbdc1910c8d1f504
SSDEEP 12288:3O4rfItL8HPfJfiRiMELvI3oEgS317rKxUYXhW:3O4rQtGPdiMLiCS313KxUYXhW
TLSH
T107B4E12A76418233D28301315BDADBD6AB3E79B5472694C33794427D1FA1BE2D33A387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2876	1B53.tmp

Executes dropped EXE 1 IoCs

pid	Process
2876	1B53.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1B53.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3352 wrote to memory of 2876	3352	2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3352
- C:\Users\Admin\AppData\Local\Temp\1B53.tmp
  "C:\Users\Admin\AppData\Local\Temp\1B53.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe FA853568BF843B11C84144D4B20B531BBAA28C787398D3A21EBD17EC68AD7727D2255B862C6CE0A504F2CB4F56B15843C3BB38022EDBAF9B59661632FB5079F1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2876

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1B53.tmp

Path C:\Users\Admin\AppData\Local\Temp\1B53.tmp
Size 486KB
SHA256 5ec7b84cb8fa51d96c346351d1420e5280e69470d5ecef4b3fd137d5da5797d6
MD5 7b981c9ab018147f6482525dae2e3efd
SHA1 864a1b45b776dae61ca7cda9ead2d3d67e58bd1a
SHA512 791e463afca13477ff5ae39d47627fd74d881f5f7164e4309fb40e092a0fc10b558223aaa32651836ea1886917f7a15d4c14af6b948e03019a559c479e5c82a2
SSDEEP 12288:3O4rfItL8HP/J/sY3yJ9IjxxrqfqqZs7rKxUYXhW:3O4rQtGPh/sYCfI78a3KxUYXhW
TLSH
T1C2B4E13AB7818233D29302711BDBDAD67A3E75B1032694C37BD4426D1FA1AE1D379386
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download