74395dc64c3621811dc1d8ca791f3509ed15e57457d2eb59ffc1e30f38beb4ab

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_6d8286bae819166f7de955f2f240463e_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260424-tr655aez2p
SHA256 74395dc64c3621811dc1d8ca791f3509ed15e57457d2eb59ffc1e30f38beb4ab
MD5 6d8286bae819166f7de955f2f240463e
SHA1 d42de2c474fe2fffd804049c9defb12bce538c55
SHA512 95cb60626bb162eb5342f7920263b1b7a0a6ad4004f50bea48d9a03fd87223dcd5f43fe1456d1dfb7acc18d82982528e473a404dd75443485ac188cbaa221024
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHsjUHxm93O4JU4SfX7XsBAN/2CJyLOmXZ:Zm48gODxbzaUM93O424SfX7cBSuVLZXZ
TLSH
T18084D02475C1C032D19701314AEAEB66593B3CB68B6568C77BE43BAD9EB13C1E73520B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4668	290F.tmp

Executes dropped EXE 1 IoCs

pid	Process
4668	290F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_6d8286bae819166f7de955f2f240463e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	290F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4668	290F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4712 wrote to memory of 4668	4712	2026-04-24_6d8286bae819166f7de955f2f240463e_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_6d8286bae819166f7de955f2f240463e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_6d8286bae819166f7de955f2f240463e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4712
- C:\Users\Admin\AppData\Local\Temp\290F.tmp
  "C:\Users\Admin\AppData\Local\Temp\290F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-24_6d8286bae819166f7de955f2f240463e_elex_mafia_stealc_tofsee.exe FCDF689E03C3B6D618D3E0F7B101273B22D7CDEBA9EEF532D7687AAEEB04BD5909745E82A443B187926B2D88DB3F2FF40304DDA6703B2FD37D9DA7F085E6C8D4
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4668

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

290F.tmp

Path C:\Users\Admin\AppData\Local\Temp\290F.tmp
Size 384KB
SHA256 d7459038e3278d37064c7dbc2d1d2515c3549644b9229646deb99187372143bb
MD5 72da4740d5e800242dd11990df8ebcfb
SHA1 528fd4d34c21fa901e47e7895f9e58f52350d6ed
SHA512 8a966eb6330dde97435414363ff94f6cbb7faf925ebd1abc61013ba7fb5b6cbedaaf8c65ae4db0878ec71cc6cb4da8a1cce94537c1d78e6f5cf0473f02c3964c
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHXDzCrwpSdb2Ek4VDQ/PfMsfj7ANHn39UPSgF98Z:Zm48gODxbzZKwpSor/8s3ANX9UPSgF9s
TLSH
T1FB84CF247585C036E19705314BE6E761593B3CB24B6468CB3BE47BAE9EB03D1AB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads