35e5a3e51d73d5a7bbc62e82ba16a93da6160acd7e003e1e32ae9dcaa7c077e5

Analysis

max time kernel
149s
max time network
121s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260423-trpwvaax2s
SHA256 35e5a3e51d73d5a7bbc62e82ba16a93da6160acd7e003e1e32ae9dcaa7c077e5
MD5 63c8ea9a42cd502bfde684c6da98f981
SHA1 4839a055e05ea45b2efcc30f0c58539a84f435f9
SHA512 034e74dfdab515f79afb84521338ae8971ae18337c14b9b65178e21438c0cb0fa4650ed03f939dde9ba02677f92a0fbdda9c4ae4d4e6452b3e3e530904876d7d
SSDEEP 12288:Nb4bZudi79LdvsCgvBw4t55Na8L1fPUA:Nb4bcdkLmb5w4t5S8R
TLSH
T1A6A4E0243582C037E19716384AEADB76657E7AB10B2268C73BE45B7D2EB03D2D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3932	D1A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3932	D1A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	D1A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4684 wrote to memory of 3932	4684	2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4684
- C:\Users\Admin\AppData\Local\Temp\D1A.tmp
  "C:\Users\Admin\AppData\Local\Temp\D1A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe 8DB2DEB5F1C65E3A066F73C3483BAF5F0B6DFC6E60EFD617B388415E1464F3B4E49FB6EB7F7B9BCF65902FD52995D2DDCFDE68E29E35C53E73AC948564D819BB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3932

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

D1A.tmp

Path C:\Users\Admin\AppData\Local\Temp\D1A.tmp
Size 444KB
SHA256 1c2c805fc06bce659198396aeaf266422130c6ae4c419e004730dcde56f05540
MD5 2ce884dba0296b793c250783a4268faf
SHA1 5ec4a98c0a1256594c7dc033b24dd4a1b81d17e4
SHA512 d95c05461becfec10f64b0b8baaf44dcd6fe0b1d42e5b2e4875154f0137c02242236a9d8abf5d6509556a3157c37beadd6a0b9bc448ca59cc6cdd1e1df1ba62e
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStPrzzRG3cRPQN1dzV9gakklEbckWVaCEKYkZ:Nb4bZudi79LamcRm15VCawoaC6ZA
TLSH
T18FA4E1243592C037E29716354BE5CB75A93A79B14B26A8C737E01BBD6EB03E1D630347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download