6f84808a9626cb3b57410cef8c7d1918a315185e1ec6b0b42629d7fc780de131

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 00:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260425-bcferagv5l
SHA256 6f84808a9626cb3b57410cef8c7d1918a315185e1ec6b0b42629d7fc780de131
MD5 00543e52d8acc42b0e82e731b5c51a46
SHA1 8df26e172871df7a07827fabac4ab5f214050fd2
SHA512 da42faae9bbb091fb59748f418beebccf5768727edc051370424542e87f1b2aa4ef10014b35097c3897aa2e53859090ca21b7af2bda9f7c7788f0157592d6491
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHCal1uvPS1vvmXy9+r5P8d495mz/YfjZ:Zm48gODxbz4aXmg3mC9+r2dT0fjZ
TLSH
T15B84DF247581C036E19701314AFAEB625A3B3DB64B6068C73BE07BAD9EB53D1E735207
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
968	EC54.tmp

Executes dropped EXE 1 IoCs

pid	Process
968	EC54.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC54.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
968	EC54.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3212 wrote to memory of 968	3212	2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3212
- C:\Users\Admin\AppData\Local\Temp\EC54.tmp
  "C:\Users\Admin\AppData\Local\Temp\EC54.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-25_00543e52d8acc42b0e82e731b5c51a46_elex_mafia_stealc_tofsee.exe 0790FB7BECE6C252328F07151AA0162E1969860682BB16065683E710C87754050D78CDE8EB867E85AA502C34B41C7F16C50BD68DD3BC8CF4A19926E2A7661228
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:968

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EC54.tmp

Path C:\Users\Admin\AppData\Local\Temp\EC54.tmp
Size 384KB
SHA256 bfe0cca9087b3929835d52e7de84f4d6b8cfe75bd8df6821e2116a13244fd187
MD5 3982cf56f9dddfe1dfd65c28231739b6
SHA1 82abcb3eb374eed79e0002feb32c659711262816
SHA512 d67220c4ad27fb8380886d6e6fcb9422472c0076e1396f3d8044be5a1b1b4ba19609f7307007b33efa2681f3a3aa60612c08e4d763ea6bedd7a8cb07902575a6
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHoEpGDM2j70Gmr5/htdYvxWr5i+9RnK4Z:Zm48gODxbzKGjJrYvxWiIZ
TLSH
T1BA84D0247580C036D19605314BEAE7622A3B3CB6876568C77BE47B6E9FB03D1A73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads