ae1600e02f77049497cd701e9b259e17d3f2a74b976c3166ff43ecb7c0184fb0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 01:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260425-bvb52saz4s
SHA256 ae1600e02f77049497cd701e9b259e17d3f2a74b976c3166ff43ecb7c0184fb0
MD5 22ee6d4d79eb0fe4f4fd76e0172e4dbc
SHA1 318c2b9f91cc96da03b0d65c305828d4470fa150
SHA512 301a435de24bccdb9a014af0a3d46e9262f4efe03ff8df97352e377001af2ffbab7c6a3a34f25809c05028b72610d5c7d0d65706b0adfa620e82bb8ca80eaf56
SSDEEP 12288:Nb4bZudi79L5omixJrX6WR3URDWIuR+KWiCoT3PcEYkEA0a:Nb4bcdkLizj5qAjj3P7
TLSH
T10FA4E1243581C037E2A705394AE6C7F5563A3DA19F22A9D73BD03B6E6EB02E1D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2580	581E.tmp

Executes dropped EXE 1 IoCs

pid	Process
2580	581E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	581E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3936 wrote to memory of 2580	3936	2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3936
- C:\Users\Admin\AppData\Local\Temp\581E.tmp
  "C:\Users\Admin\AppData\Local\Temp\581E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_22ee6d4d79eb0fe4f4fd76e0172e4dbc_elex_mafia_stealc_tofsee.exe 3DEE60E7912F2CC93BC8CECF41B4A0F059631B0FB165EDD6CB82FD160284B1A33329D64D3FC0B75449C80CC4C705AEE51B405A4195DB8EC950C4433A3DD1563C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2580

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

581E.tmp

Path C:\Users\Admin\AppData\Local\Temp\581E.tmp
Size 473KB
SHA256 16e3f5acc4881aa746f685df7f20c66249d4cbecc73b2af3a95408edc72c4bf8
MD5 f86bff7608bcab7d0b34a573ac625bcf
SHA1 b4a8afecbbe32a67099efcc4d07b28781da776fa
SHA512 56d01b42cb3c91796a16e66394a94f2e8e690c8efcf9a2bf08347a58e3e5cd48a82319f940b1c1fbf1c96ac38d8a9be9b3413e541986a9b045de0bf0718c6863
SSDEEP 12288:Nb4bZudi79L92JG8JxxOAG2cbZc/tWgrA0a:Nb4bcdkL9KGixOj24ZeWH
TLSH
T11AA4D0253581C037D19702384AE6C7B5697A7DA19F7668CB3BD43BAD1EB02E1EA30317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2580-5-0x0000000001760000-0x00000000019EB000-memory.dmp

Download

memory/3936-4-0x00000000009F0000-0x0000000000C7B000-memory.dmp