9df5ce2b0e381f5c3795734ccd037fa5f49f9bcc1edda09a52b7140a25bf6b0d

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 12:30

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260424-ppynraav6k
SHA256 9df5ce2b0e381f5c3795734ccd037fa5f49f9bcc1edda09a52b7140a25bf6b0d
MD5 7d51cec8d2b4d9c5e08f9260839d4883
SHA1 b7372071f75b91c9a1f4c1980970fcd6ef404fa9
SHA512 5800fa7543b0efe2023a902c96abd27951e58c78b2d8c7fcaed820eb1f81a67caaf3797182876fd5832d8ff7447dcf377f35320d9c6a254bf2ba36624975eea9
SSDEEP 12288:3O4rfItL8HPC1R4RqiMUNcIk8l6kW6rjTK7rKxUYXhW:3O4rQtGPMRriX+8lHk3KxUYXhW
TLSH
T1B1B4E12976818133D29202315BDADAE6B63EB4B10726D4C337D8427D1F61AE1D73A39B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1680	E2CE.tmp

Executes dropped EXE 1 IoCs

pid	Process
1680	E2CE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E2CE.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 976 wrote to memory of 1680	976	2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:976
- C:\Users\Admin\AppData\Local\Temp\E2CE.tmp
  "C:\Users\Admin\AppData\Local\Temp\E2CE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_7d51cec8d2b4d9c5e08f9260839d4883_elex_mafia_stealc_tofsee.exe CEE8122487FA1DB362126388F0BC27FC76B5DCE4E169FE3C788B8171F219AAEAA6A61B30E2F0C798C9277229EE14EDB37949E3DC73D7DC805E9A97B7D8497E52
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1680

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E2CE.tmp

Path C:\Users\Admin\AppData\Local\Temp\E2CE.tmp
Size 486KB
SHA256 c633346cc003441fdf031283b6efaef08370e3250fd27dc8d2d5b1f503b01009
MD5 e57bb2ba20c0ca347d2cb207626245c7
SHA1 04181cd5ef9c7fc3dd1fe44b272b3aabff774e28
SHA512 a72cf79751e9ab8ec822cef6f2f64f2d19274f517de5ccaebc26a28ee47198f6e499a70fa86dfd27c6a305b05b632c73482e384239fcb2ea2408bde0038674c1
SSDEEP 12288:3O4rfItL8HPWMhhdYeKNbS8CEDdU4kkwY2uccZ07rKxUYXhW:3O4rQtGPxhONNCcbccm3KxUYXhW
TLSH
T132B4E1267681C233E29202351BE6DBD6B63E79B50736D4C337D8026D1FA16E2D37A346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download