0d702ce11227a4196592cb801438e12729aecfd5294b9b347c96f2122783dffc

Analysis

max time kernel
149s
max time network
112s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260425-b2vkzagz2p
SHA256 0d702ce11227a4196592cb801438e12729aecfd5294b9b347c96f2122783dffc
MD5 34a7890114c7ce8634fbda9c397d5fdc
SHA1 2a753a1fa1e5b16e3084e8a7c11213ce8901c6af
SHA512 d626d67ccd1df6be8f13242136241824e2fc68f546907d7faee709012d7c334f49cab381ad13bd0380b215f3db4707c1ef29c2d19ba3d70c6ba669522f492536
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvU1wV1Ak3QDwaYo66wsadEajMr5l1QY0KjJP:Ci4g+yU+0pAiv+Wuc8aYogILQY0CJ/n
TLSH
T19F94F1303586C033E29716348BE9C766267E79A21B2668CB3BD41BBD2E603D1E774357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4032	DD6.tmp

Executes dropped EXE 1 IoCs

pid	Process
4032	DD6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DD6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 4032	3128	2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\DD6.tmp
  "C:\Users\Admin\AppData\Local\Temp\DD6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_34a7890114c7ce8634fbda9c397d5fdc_elex_mafia_stealc_tofsee.exe 67BAB1829C532FE1101F9527793E75AD380626C533202A938F44BF5F46460E0227F486BFE3ADBB7CF1C2EFB13C48D52A8CC21E5782F9F95BBEBCAC0A73C7D88E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4032

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DD6.tmp

Path C:\Users\Admin\AppData\Local\Temp\DD6.tmp
Size 433KB
SHA256 1214aa35ea2fb931d202c948dd109ab62146de28bd029cdaa0414b270fa3a140
MD5 35ae90d896e49f947fec2d13ba8ab6b4
SHA1 f212782d849a27e215ff74382e220517ea99f68f
SHA512 ec7c9fb1e683e493dfd62d7121f6260d9253ba7ce60ce0a0e657941d4d3a38e7370c3080d78ef72f526cdd54e18d98992a4aa4ad0a14adce367e1c8003a388d7
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvOb/r3eZoosGexXnMQXDpHyQxmHw9C0brn:Ci4g+yU+0pAiv+GTOZoBGOMqDEQxmCXn
TLSH
T16294F1203592C033E19715344BF9CB662ABE79A14B26A8CB3BD02B7D6F602D1D73534B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3128-3-0x00000000013D0000-0x00000000014AF000-memory.dmp

Download

memory/4032-5-0x0000000001410000-0x00000000014EF000-memory.dmp