74ce21c5c0d1ab7a1c30b06f40bc5079b80dfc6ffcc8bbcaa8ceefb6e4d7d0aa

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 16:05

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260424-tjljfsey2n
SHA256 74ce21c5c0d1ab7a1c30b06f40bc5079b80dfc6ffcc8bbcaa8ceefb6e4d7d0aa
MD5 41bc003192edad9ec8283daed3a6f57d
SHA1 aa0a6064eedd7df55c4eb878d037aaed4fb7015d
SHA512 756f17da8b7e7fa20a329b1468483f44d9ea36bcaf29135b123d5fcfb1c9422c1ef01bbbb173e2e37094347b2ab441e7145e0bb702ea0c4355ab81a116299bcf
SSDEEP 12288:qO4rfItL8HGfJOeSFMrwgfAMOnIXK9z1sg+SB7bWmeEVGL:qO4rQtGGvSFMrwiANUOsg+KumeEVGL
TLSH
T191A4F1397281C133E59302711BDBDBAAAA3E79B44726A4C337D4427D1E616E1D33A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3348	5762.tmp

Executes dropped EXE 1 IoCs

pid	Process
3348	5762.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5762.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 3348	1864	2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Users\Admin\AppData\Local\Temp\5762.tmp
  "C:\Users\Admin\AppData\Local\Temp\5762.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-24_41bc003192edad9ec8283daed3a6f57d_elex_mafia_stealc_tofsee.exe 96B12898247500643546D61E096D1B5595505E4AD011CD879FEDE36B0FCA6BDE5BCE3F943E632C3A711D3D6165A58DD79475EAD63152F3D59D5ADB15F4CB5424
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3348

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5762.tmp

Path C:\Users\Admin\AppData\Local\Temp\5762.tmp
Size 468KB
SHA256 61f71e005e08b5be383db242ee70b231f871ac197a47e72d778aeca568b6e98c
MD5 2b4dc387e6e1e131381b99f561b4c7ee
SHA1 cfc3144e8fbd66543780239c5f5a6471ab9d48b3
SHA512 cc665261fa22e0b8bdbeac6a052708b090451ecb53e9d9d6dfdf6dd320733fd7e888ac2ac479b29f0ed6ec3fcf6924d9924fa2232b40262ce2fec5cb0457fdaf
SSDEEP 12288:qO4rfItL8HGgJmEZU0h4RecM7XAC7bWmeEVGL:qO4rQtGGgJTh+eckNumeEVGL
TLSH
T135A4F13AB241C133D19302714BD6DBAAAA3E75B14326A4C33BD8437D1E656E1D73638B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download