3e30cd3f42d35b1d2f2699ffc55d753f92e44dfa095379483000f44350a73c1b

Analysis

max time kernel
149s
max time network
157s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 13:09

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe
Size 435KB
Sample260424-qdrazabv2p
SHA256 3e30cd3f42d35b1d2f2699ffc55d753f92e44dfa095379483000f44350a73c1b
MD5 820a516e7bff4b35f2f17fdb3a0b98c6
SHA1 2ec2af9ccdc3f32e5d1f9bcd024f63003f45af65
SHA512 2133ebc3ff4e8f4f7446c44cd7043640c6d1e4b4f205ae2d60cf8e64e90bfea1c96f27bafd026c26078f9ce36f691c7732e600444b4bbc0e03c2badf5cb83277
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBYmt4g8c1PYWFTiKd4GDwlmiDNZNlTU+aT+JK:9W4ufepiqKQ1mzugvrhG/7lY+J
TLSH
T1A594E0217186C03BE1A705348AF1CB6569797DB04B36A4CB3BD02BAE6F746D1DA3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4136	39B8.tmp

Executes dropped EXE 1 IoCs

pid	Process
4136	39B8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	39B8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1416 wrote to memory of 4136	1416	2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1416
- C:\Users\Admin\AppData\Local\Temp\39B8.tmp
  "C:\Users\Admin\AppData\Local\Temp\39B8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_820a516e7bff4b35f2f17fdb3a0b98c6_elex_mafia_stealc.exe 9B0B5F533FED1CC0B1A2420D093F9E023ABA5E7DE7FC58F4527340A3DE6E48852120B7B590A681B6D494195684ECA89BD0171C54A90882711F118A7412F576A5
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4136

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

39B8.tmp

Path C:\Users\Admin\AppData\Local\Temp\39B8.tmp
Size 435KB
SHA256 52f82123e32f46d6e9c61ea17e1cbf679ba45982727178ec81899f8ec75c8b5c
MD5 53e1a1361ac44361d291518204fe6f87
SHA1 dbc9deb773115af173086da33fbae585397f41d8
SHA512 24537df27710efd5af74bda1cad14256f26d2c31905b22964d7516ff686c3ba6c94f9467e51d03fa66d368c7ef64d3c5be4e1169103e4c25d2b2958fc81f8ee7
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBY+wI0EqY2ErN90GvQ/QfofXOQ196uc1JK:9W4ufepiqKQ1mP0/wLWof2OQT6uc1J
TLSH
T13094E1253682C037E1A605398BF5CB695939BDA10735A8C73BD42BAF6E742C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download