42ebb2999dbff97f72314cf8f8b56d6bdab561b3f8832745b275ebe0ab9eccad

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 13:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_cbccc0347c06ddb1351352eb2f2d0053_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260424-qmw8ksbs8t
SHA256 42ebb2999dbff97f72314cf8f8b56d6bdab561b3f8832745b275ebe0ab9eccad
MD5 cbccc0347c06ddb1351352eb2f2d0053
SHA1 c408617d865f924e822cd096c5ab64514a5a0ea2
SHA512 675496b5c2142654d986a871f66d8c5c635fa6a8575879c6945ca0f20917fe4c3d4d33930718400ecb071389f46b3928492ec7924cf3d2426a18570228b7d1b6
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFJeRxOqmWzHUfB67hmM/M4GgXkH0ZNNqHR:gZLolhNVyER+677/VZNNqHR
TLSH
T1AB94CF24B2C1C036D09301354BAAD7B2253A7DB15F6164DBB7983B7D2EB03D1AA7931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4276	E9C4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4276	E9C4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_cbccc0347c06ddb1351352eb2f2d0053_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E9C4.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4276	E9C4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3100 wrote to memory of 4276	3100	2026-04-24_cbccc0347c06ddb1351352eb2f2d0053_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_cbccc0347c06ddb1351352eb2f2d0053_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_cbccc0347c06ddb1351352eb2f2d0053_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3100
- C:\Users\Admin\AppData\Local\Temp\E9C4.tmp
  "C:\Users\Admin\AppData\Local\Temp\E9C4.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-24_cbccc0347c06ddb1351352eb2f2d0053_elex_mafia_stealc_tofsee.exe C0F6A57A191FD445AD0441E081DDA7A8DB8F798F8FEC407FEB993C1713F4C570ECC35BAA2C0E06DBC02BC3373A44C760EA2DC81008A820853F4F45C3CC5B7EB2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4276

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E9C4.tmp

Path C:\Users\Admin\AppData\Local\Temp\E9C4.tmp
Size 428KB
SHA256 3b4743be1548747c2d3c3df6569f0c056a95734c687d91b04da4149ceb62056a
MD5 79fe2ff101f5badad8b8b5dd89eaa40f
SHA1 1565b917872169c6795679124f1fbab4d9cbc257
SHA512 c128ed983b81d5e674d8b613c8866aa29d17d7906a9da18c4753fb278110d1d25cf9a67dc5878d73ee634bceb39f913cad72441bd9b967ff51a16a8b18fbe30f
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFbfHOPdOxDuTxnTJk42JqHR:gZLolhNVyEM0AuTxnT5CqHR
TLSH
T1C394CF25B2C1C036D09201314AFADBB5153A7DB15F6165DBB7D83B2D2EB03D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads