97ef45fd136b0862950578085b7817eedb4a2be4d336a984789f6a3802a0d8f9

Analysis

max time kernel
149s
max time network
119s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 04:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260424-erba5aev6v
SHA256 97ef45fd136b0862950578085b7817eedb4a2be4d336a984789f6a3802a0d8f9
MD5 816a95e588eedb9808b6c4ddf9bf02fc
SHA1 5290ae1705b20b7bfb220539a57594c5a4de5c06
SHA512 c82c940b82e369dac147ed58fe3c47ac72dd99803029d148aa1696be6c4710c276565897358f98c699ba00220f7b50bf242c82a6371d785012c8baaafc0a0280
SSDEEP 12288:3O4rfItL8HPOVfuN5lnSYZsoUurmCvJtx5Tx7rKxUYXhW:3O4rQtGPWfsblnx593KxUYXhW
TLSH
T158B4F12A7681C233D28302351BD6DADAA73E75B14776A4C337D4427D1FA1AE1D33A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4436	2650.tmp

Executes dropped EXE 1 IoCs

pid	Process
4436	2650.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2650.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3048 wrote to memory of 4436	3048	2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3048
- C:\Users\Admin\AppData\Local\Temp\2650.tmp
  "C:\Users\Admin\AppData\Local\Temp\2650.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_816a95e588eedb9808b6c4ddf9bf02fc_elex_mafia_stealc_tofsee.exe 8FB90B72648445E11A78D222B2E5BCAE98D1F1506A0FD888740CF96BD18FCFAD47304C7A8C0EB298381CE5B1F406DA6554DD377F3D2467045C0178BCB0919505
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2650.tmp

Path C:\Users\Admin\AppData\Local\Temp\2650.tmp
Size 486KB
SHA256 5c0cb5d0012d511f6c9380c5cc55165d9235d7b563ce2072953eeab1d8e30a17
MD5 571abf0d002939c82633141ceafb62f7
SHA1 9c5a614aefa34dbdb41629b06bf7cd4e9ebe316c
SHA512 6a23b0eca40043dac2f10d5d0f27eb386d09ca540ae2e2132f5c87ffce9f5108b72e7cf8511f762a404fcb72d598677f891e1d20a38d2ee6ca97f6e83f82d51a
SSDEEP 12288:3O4rfItL8HP4j5jpNgeH2kbLV6y+6yhdm7rKxUYXhW:3O4rQtGP4pFH9LVth3KxUYXhW
TLSH
T1CCB4F12A7281C332D2D302351BDADBA6B63E74714726A4C737D8426E1F61AE1D37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download