2d975cb79f285175f4a6a407c705fcaf9a4275dedda5b9395e36b1f9a4f856a6

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260423-tsb2daax4t
SHA256 2d975cb79f285175f4a6a407c705fcaf9a4275dedda5b9395e36b1f9a4f856a6
MD5 929eaf89e8b7c12ac1c2a46ecf9696e3
SHA1 7dae517c50f0982a83cf28fe274f8575b63ee265
SHA512 e40da248d4e1c83629abc5d389c73cd311241dac755d2b8b4c75b3aef863e12c17a9bea7d2285eb666665383726b127760fee46dd2fd106ce440eb3c35a6b88d
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvL0+ePQwLBc6f/063MWZm5PDqfquH7XSgzn:Ci4g+yU+0pAiv+l0rPQwlbxmtp1cn
TLSH
T12994F1353581C033E6A715344BE5DBAA15BE35B15722A8CB3BD41B7E2E603C2E63934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3892	3D91.tmp

Executes dropped EXE 1 IoCs

pid	Process
3892	3D91.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D91.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3496 wrote to memory of 3892	3496	2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3496
- C:\Users\Admin\AppData\Local\Temp\3D91.tmp
  "C:\Users\Admin\AppData\Local\Temp\3D91.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe 2E3300131FB3B859B45E6BFF053E50AECD9140F1D55183B5F9ED6945B858993BAFEFD3F49F8637ADEB521484D078E640EE3ECD2BE23C3DA194E974445637FA23
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3892

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3D91.tmp

Path C:\Users\Admin\AppData\Local\Temp\3D91.tmp
Size 433KB
SHA256 2a3c20daad4c4bb77956df6ed545d68f25fe3514358d851050131efe56afc7ff
MD5 60173af0e31a8bf486b0a288380c5ca9
SHA1 21bd1dce2be5e89771191d81ccb3d4c5bc495b64
SHA512 58f4afddb42e45c0c945a0aa658110e5535539b9c2bcb45a936936d8c8a5821cf018a3ebdef1b54cab54b42874475e953786b06423b88d90a860f902ee4ca232
SSDEEP 12288:Ci4g+yU+0pAiv+hzbDjptms9xoqWx/19Q7n:Ci4gXn0pD+hDjptmsTWx/7u
TLSH
T16194F1203582C033E5A715394BF5CB9565BE74B24B25A4CB3BD40BBE6EA43D1E63834B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download