29163ce9a2a1d6f612b18d6fbdd068f07d4d37bbc774088242b2951220e75921

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 12:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe
Size 535KB
Sample260424-ph3dcshw31
SHA256 29163ce9a2a1d6f612b18d6fbdd068f07d4d37bbc774088242b2951220e75921
MD5 166ecadabafc9f01c902e960c1742ff2
SHA1 e9ea11daa6d49bf27f94195ef3f8d982f4760b0c
SHA512 a9b55b0be4d864bd630860b00c6d4ce7440c9fa389bb92279587706b7749852f479efc36971cb6e906056a1dbf4aa2b2d5d042918a8e80f945175b7ac110f220
SSDEEP 12288:si4g+yU+0pAiv+JzAczeuddnwYaZgVvMxUlvjosTdcG93Dn:si4gXn0pD+NTrddnwY3vlvjRhFJ
TLSH
T187C4F1203592C033D6A719354AE4CB65567F39B64726A8CF37C42BAE6EB03C2D63435B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
4272	1393.tmp
3440	2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1393.tmp

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
4272	1393.tmp

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 4608 wrote to memory of 4272	4608	2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe	80
PID 4272 wrote to memory of 3440	4272	1393.tmp	81

C:\Users\Admin\AppData\Local\Temp\2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4608
- C:\Users\Admin\AppData\Local\Temp\1393.tmp
  "C:\Users\Admin\AppData\Local\Temp\1393.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe A26AE3E3E6B5B4F9C2018E282A4D01D713E076E16756C9A78546C0860849315FF3104241E65A5ECDABB9B894808758F4B9A5C514CBC9479EEEA3F3EF2CABCA9E
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: RenamesItself
  - Suspicious use of WriteProcessMemory
  PID:4272
- - C:\Users\Admin\AppData\Local\Temp\2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe
    "C:\Users\Admin\AppData\Local\Temp\2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe"
    3⤵
    - Executes dropped EXE
    PID:3440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1393.tmp

Path C:\Users\Admin\AppData\Local\Temp\1393.tmp
Size 535KB
SHA256 d44bec826081c57681c31ef3bd83161132c923ceebbc3cdd3b5d224736058a8b
MD5 5d0e6ddd9369bbb6020dc7c2e6d3e91f
SHA1 32948dc8a43443c7f7ab25aa27bf3690791d7b54
SHA512 f0cb1ac15b89000d13d28f1c332bb794e2aed9f91e43e2cdf273d84fb94e87ababdde7787b13ccdb25cb4e77c841745de37c66ec7533285319359b9c762219db
SSDEEP 12288:si4g+yU+0pAiv+OeY3Qpn41MwrYrHVKsOAxUlvjosTdcG93Dn:si4gXn0pD+Oez42wwMlvjRhFJ
TLSH
T184C401203582C033E2A709304AF5CBA6667A39765366A4CF37D46B7D2EB43D2D67134B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe

Path C:\Users\Admin\AppData\Local\Temp\2026-04-24_166ecadabafc9f01c902e960c1742ff2_elex_mafia_stealc_tofsee.exe
Size 255KB
SHA256 aba5c0bff0442597ff8743b4fe7d28de945b78be01eb88fc4a95cadd1fbee409
MD5 b7fd76103054f562a11ce616d50a0611
SHA1 7473656e5a33b9ecc401985f917f65054bcbd16c
SHA512 2a2996476dbfdcd50c39c08dc91a179eff4f016013707c9c0972c6e7a0e179b9da4fcff5e2d4d4883a31312bfefdb9a88d1490e1baaa4728a516c5c7f7bdfbd2
SSDEEP 6144:+0KCJyiHB+nqr0FpIlsUuDnhqK1xOuSSln:td90FpIGUwwUx/
TLSH
T17C443811B781C037D4A3013149FA8675AA39BEB2176495CBB3C43F6E6E316E26E3171B
MD5 SHA1 SHA512 SSDEEP TLSH