4e2e04f04cb3a90aa189c78dc76376622c6063f3c910a1b79ec20187c8717f14

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
24/04/2026, 16:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260424-twtetset31
SHA256 4e2e04f04cb3a90aa189c78dc76376622c6063f3c910a1b79ec20187c8717f14
MD5 85c8215031f3fe47145b361731ccc3e1
SHA1 5f7723e332fc0cf688fa2f2bc1a9d4095dd00e65
SHA512 9bf2b9ab06c9e8935032758929bd1d2bbef98f997b9d8e614a65d9d0c777dcfe01a24f80db677548b591709e316c5d2b236f2179867b48f49bb3d2c88cdf4680
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnaQWu4a3EV2ENGUkkkO4c++CXvKqkpC/2P:U6PCrIc9kph5DWu4a4xGUAiqGCe
TLSH
T1E694E0343181C037E19316304AE5D7A65A3A7E714B32A9DB2BD467AD2E713D1EB38347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1028	50DA.tmp

Executes dropped EXE 1 IoCs

pid	Process
1028	50DA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	50DA.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1028	50DA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3632 wrote to memory of 1028	3632	2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3632
- C:\Users\Admin\AppData\Local\Temp\50DA.tmp
  "C:\Users\Admin\AppData\Local\Temp\50DA.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-24_85c8215031f3fe47145b361731ccc3e1_elex_mafia_stealc_tofsee.exe 016A0DFE9CF6B0630E9E6A60DD92BF500CB176EE3E11CE9E25D55578D9BD1A14CB6AA12D8CBDA9AD11E23DF36C82839E669F17F0FC64AFA4379FA4BEC00E7B70
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1028

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

50DA.tmp

Path C:\Users\Admin\AppData\Local\Temp\50DA.tmp
Size 412KB
SHA256 b7ae6edcc70e331e37aab78271155ea12a8cc7be401f774fd1254c7b82553ab0
MD5 6c70eebecd396e87d5f56fc2e598d2b2
SHA1 45f4eb465d34e8de0cfe0d8956b7587b33afc91f
SHA512 f151e70cf5c4dedcdae24f1c93f1ec6a9ae6098ee7bc741e4c2074595e0a0461e69bba0e1a012f3e4ebef1fb643c8424ac42bb7d8219db9057a995f95bc0f34a
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnabrjz9mK2QgOJu1LJG1RCN4EMzCiP:U6PCrIc9kph50brH9mrXOJu19G1Rii
TLSH
T15194E0303185C036E19715308AEADB66693E7D754B6668CB6BD46BAE2E703C1FB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1028-5-0x0000000002700000-0x0000000002764000-memory.dmp

Download

memory/3632-3-0x0000000002320000-0x0000000002384000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads