9ad378c7e8040a1714c46eb94f396dc20de5ff4503374f1c1ec28961f61cbf44

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
23/04/2026, 17:46

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260423-wcf2hadw2x
SHA256 9ad378c7e8040a1714c46eb94f396dc20de5ff4503374f1c1ec28961f61cbf44
MD5 6ea197fb5e51e67ffd719f97096e5ce9
SHA1 79418c8fbb5fa97fa97292af59ba9f9d05597c7f
SHA512 c1a0e33a5fb875c558273fa55af6480dd741fdd5689dd0e4ec02c175ac4ee4ee655d53496ee4c9d9bae788ccf9e7222407597744f4d2c9cbb25106bfd7120c13
SSDEEP 12288:Z594+AcL4tBekiuKzErgA2+67kLBsnBNJGFArwl:BL4tBekiuVrBF67klsUx
TLSH
T13D94F0353486C033E29715384FF5D7AA5A7E39B64B2668CB3BD01B695FA02C2D73434A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5088	F9B.tmp

Executes dropped EXE 1 IoCs

pid	Process
5088	F9B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F9B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5084 wrote to memory of 5088	5084	2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5084
- C:\Users\Admin\AppData\Local\Temp\F9B.tmp
  "C:\Users\Admin\AppData\Local\Temp\F9B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_6ea197fb5e51e67ffd719f97096e5ce9_elex_mafia_stealc_tofsee.exe 582669E62A035F444294CD4067B0A4AA7211C21F7C2C2CFAD303DC08CD20F30814354C835F6088D3049803BE448302C6E7791A5970BD5D0FBFC475824779DFEA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5088

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F9B.tmp

Path C:\Users\Admin\AppData\Local\Temp\F9B.tmp
Size 428KB
SHA256 b7dcd854af836d317389607a7dff7c1f4912d14a931d47cf6f7265ff93e1627a
MD5 b58895286b26039ae80b9f0b6f159aa1
SHA1 7a6723b78463cdcc7bc4912610d137f8b68ed082
SHA512 c14a4ab5c75687b9b73f4408c60105ca30a99d3ae0b4005d7892f609eb8c110bdb37d51d6ef559079b4af18782b276d8cc02ec91f0b70859d63970fa3a1f74dd
SSDEEP 12288:Z594+AcL4tBekiuKzErsZSGUBOnJMn7GN0gye97l:BL4tBekiuVresBOn2GaLe97
TLSH
T15C94F1357186C033E2A711388BF5CB65593E79B24B22A8C77BD40B7D6EA06D1E634387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5084-3-0x0000000000F90000-0x000000000113C000-memory.dmp

Download

memory/5088-5-0x0000000000950000-0x0000000000AFC000-memory.dmp