Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
24/04/2026, 14:37
General
- Target 2026-04-24_fdf47ef624c047b8b1d8ae8093348144_elex_mafia_stealc_tofsee.exe
- Size 465KB
- Sample260424-ry481adt81
- SHA256 92702c3fe6f8bb5a41c9671828d0e5a8bccc229885bdca6ea2c33b274197247a
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 11 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-24_fdf47ef624c047b8b1d8ae8093348144_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-24_fdf47ef624c047b8b1d8ae8093348144_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\467A.tmp"C:\Users\Admin\AppData\Local\Temp\467A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_fdf47ef624c047b8b1d8ae8093348144_elex_mafia_stealc_tofsee.exe F667C774F809F6BB2CC3B2B4B7895A715B5DA46FB2F3EFD305C2C4FEAD5B04898EAD0CF43F8DE6F02BC83A1E6BCC20654F3A50F2F417ACE1F08C054FB0D32C102⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2026-04-24_fdf47ef624c047b8b1d8ae8093348144_elex_mafia_stealc_tofsee.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-04-24_fdf47ef624c047b8b1d8ae8093348144_elex_mafia_stealc_tofsee.doc
467A.tmp
sist02.xsl
CUSTOM.DIC
ExcludeDictionaryEN0409.lex
fb3b0dbfee58fac8.customDestinations-ms
memory/1368-4-0x0000000000D00000-0x0000000000DDF000-memory.dmp
memory/2524-20-0x00007FFC1CF40000-0x00007FFC1D149000-memory.dmp
memory/2524-54-0x0000024ABBA10000-0x0000024ABBABF000-memory.dmp
memory/2524-22-0x00007FFC1CF40000-0x00007FFC1D149000-memory.dmp
memory/2524-23-0x00007FFC1CF40000-0x00007FFC1D149000-memory.dmp
memory/2524-17-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-16-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-24-0x00007FFBDA6C0000-0x00007FFBDA6D0000-memory.dmp
memory/2524-25-0x00007FFBDA6C0000-0x00007FFBDA6D0000-memory.dmp
memory/2524-15-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-18-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-53-0x00007FFC1CF40000-0x00007FFC1D149000-memory.dmp
memory/2524-21-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-55-0x0000024ABBC40000-0x0000024ABBC48000-memory.dmp
memory/2524-19-0x00007FFC1CFE4000-0x00007FFC1CFE5000-memory.dmp
memory/2524-203-0x00007FFC1CF40000-0x00007FFC1D149000-memory.dmp
memory/2524-196-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-199-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-198-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-197-0x00007FFBDCFD0000-0x00007FFBDCFE0000-memory.dmp
memory/2524-200-0x0000024ABBA10000-0x0000024ABBABF000-memory.dmp
memory/2524-202-0x0000024AB33E0000-0x0000024AB3512000-memory.dmp
memory/2612-14-0x0000000000C00000-0x0000000000CDF000-memory.dmp