9157e0518fcb6744e9a2b69e29122aecbd92055eb6791fd331ae08d5369e81d9

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 14:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_f99c6510a111b04f633d0c0f4cd9bf4c_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260424-rx47lsdw2n
SHA256 9157e0518fcb6744e9a2b69e29122aecbd92055eb6791fd331ae08d5369e81d9
MD5 f99c6510a111b04f633d0c0f4cd9bf4c
SHA1 9f6127c17a6c344ef8b199db50491fd6941a8d35
SHA512 69daef808d1d8242922b2e628b401253cd21248e65efaabeb03274d4b44d251b610bd314deb58b890119b1bc67ed3c2dc0f3b80a51fad2795ed75c0256a3a266
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYr+wtMT5IWayQIJbkVG8WkiD7X402jThCw9J:fd4x+ePixnXQjot3bsbkh9ivI02swP
TLSH
T10294E1207586C037E1A705344BE5CBAA5A7A7DB10B32A4C73BD42BAA6FB41C1DB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4348	4AA0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4348	4AA0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_f99c6510a111b04f633d0c0f4cd9bf4c_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4AA0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3824 wrote to memory of 4348	3824	2026-04-24_f99c6510a111b04f633d0c0f4cd9bf4c_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_f99c6510a111b04f633d0c0f4cd9bf4c_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_f99c6510a111b04f633d0c0f4cd9bf4c_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3824
- C:\Users\Admin\AppData\Local\Temp\4AA0.tmp
  "C:\Users\Admin\AppData\Local\Temp\4AA0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_f99c6510a111b04f633d0c0f4cd9bf4c_elex_mafia_stealc_tofsee.exe 806E31481EC7979159BAEC692C69D355C5C0EA78D1BF0817BB9F02534DB3E43D72063619137B7B694B8E009F4DD9BC2296F2B0A2541BF687804017685E3F0F69
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4AA0.tmp

Path C:\Users\Admin\AppData\Local\Temp\4AA0.tmp
Size 435KB
SHA256 512b683731a4b74c26d922b5b35b37402e468c39f63cd824abc02224e41044e8
MD5 19f3843ecb7bc48bab6601056929d033
SHA1 406450803a3092cc8a01532d04766eb7e820eea9
SHA512 76921cf8d677256e0188c04bf1f9ad33367ee54a66f4438a5f5604c3b89612dc3e567c6c19e6608b04b342216076ba1138a48503fa7492121fbbf42076a0722d
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYkhsrKzouP2iPdev8zpbf4yQhTVtuRx5zw9J:fd4x+ePixnXQjbsPuP3PqQby25zwP
TLSH
T17B94E0213582C037E2A606348BE4CBAA59797DB40B36B4C77BD427AA5F702D1DB3534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download