94b505556bc8c8986b54c2a42cd516c142c46e92155a7ce17894c5f2bde62d64

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260424-plbptaat5j
SHA256 94b505556bc8c8986b54c2a42cd516c142c46e92155a7ce17894c5f2bde62d64
MD5 3d43609a8b3a4f346725e3f8b9a11da8
SHA1 8e7040fdab222ecb6081633fd3368cfcb1b78521
SHA512 682ac6f4f92b266a7b1a706edc923ab44becc8d8577433176a163afa36b772b303a2fc653efca2e418ab5d0714cbc646805f2b4970adfa68670d1b0c32f62391
SSDEEP 12288:U6PCrIc9kph5Ezpecp3nMzuQxTLikjpo:U6QIcOh5EdM9xp
TLSH
T15A94D03435C5C037E29316308AEADA63193A7D758B62A8CB3BD467AE5E702D1E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3652	2A66.tmp

Executes dropped EXE 1 IoCs

pid	Process
3652	2A66.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2A66.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3652	2A66.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 484 wrote to memory of 3652	484	2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:484
- C:\Users\Admin\AppData\Local\Temp\2A66.tmp
  "C:\Users\Admin\AppData\Local\Temp\2A66.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-24_3d43609a8b3a4f346725e3f8b9a11da8_elex_mafia_stealc_tofsee.exe 33E7E022C0C9FF6DED835A9577359F28FAACB9EB16FDFE5D52B340BD6E7BC5519811F631705A321D0BCC436E9EDEF9BAD417B1070AAB06FBD72566C0EEF96ACB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3652

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2A66.tmp

Path C:\Users\Admin\AppData\Local\Temp\2A66.tmp
Size 412KB
SHA256 ce794fada9df8a3d1acfc08280d2cc543ed093f42f90110225473b5be1ad6bac
MD5 461fa3be139457f684cc7fb0843a7d50
SHA1 db9f8793b16cbb141e34975c2a8ffbd42216d183
SHA512 12acb63302a65cc8a8511008b481e1a88c2f40a8db7bacb66b74b54260a29d0eb23e51514e1c5a49d96dad3f51a50b89c89840c4cf8093d2445393d83bb93382
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnKPoa+vdTxAq3szJWo7boarWmd2XcVCkf5P:U6PCrIc9kph50Aa+Tj3s1Gaamd2Dm
TLSH
T13F94E1343581C036E1A305348AEADB76293A7E755726A8D73BD46B6E2E703C1E738347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads