907a8b58244a441f9c08c93381e2f135450068bc6a55cb644dc727799243762a

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 02:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260425-c1mdmscy2v
SHA256 907a8b58244a441f9c08c93381e2f135450068bc6a55cb644dc727799243762a
MD5 a359ccda2faabf035c4339d2f78b04d5
SHA1 9856ac184c3471a605d8a82ebcc648c6e6a5eba5
SHA512 097d4b7d0cc2595814cf71d84b25051f18f4163f544a5a0257c2ed8f0332b8d05bf75bba54fec25abd0bf180ab631e3ca9c2d5b01779a117d8eb3114ae06447b
SSDEEP 12288:aO4rfItL8HRH7/pDnjo/qGpXG+lmrqT77K9wlsDpVFd:aO4rQtGRH7tkqGF/meT7+9wlsDpVFd
TLSH
T17AA4F02A7685C133D29301755BE6DBAAB63E78B41726A4C33BD4026D2F617E0D33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4012	F915.tmp

Executes dropped EXE 1 IoCs

pid	Process
4012	F915.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F915.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4532 wrote to memory of 4012	4532	2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532
- C:\Users\Admin\AppData\Local\Temp\F915.tmp
  "C:\Users\Admin\AppData\Local\Temp\F915.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_a359ccda2faabf035c4339d2f78b04d5_elex_mafia_stealc_tofsee.exe C8436826EBEF81B7F041B6DE159E4B08E818C7186327F5F3E509F367973D41411DC6FE8133B5F185D5CEAD128E0DA5EF8A14AF6A3936420B853ED6911A6EAB68
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4012

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F915.tmp

Path C:\Users\Admin\AppData\Local\Temp\F915.tmp
Size 476KB
SHA256 c3a683bf424ed3f4dbb089189a3af6e23230debd75294980c12eec92bdc9ab16
MD5 ac8c6a8b269128be15973739624f0abd
SHA1 d80d49c5e0afbe3166eefb793d037a888a9ecce5
SHA512 60bffe68290d15c4f10d1da3c5d8f13beb982abaf5d8ff7589173118ef99a9e13d8d3522ad374e913d0fe0ddec581c145a10a82246f55cf595407d14e4e8221e
SSDEEP 12288:aO4rfItL8HRORRO9sPHbGrQuqbRkF7K9wlsDpVFd:aO4rQtGRJsP7GrQuAkF+9wlsDpVFd
TLSH
T137A4F12A7641C133E29302350FD6DAD6A63E78B5132A94C37BD4427E2F61AE1E376317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4012-5-0x0000000000CB0000-0x00000000012B2000-memory.dmp

Download

memory/4532-3-0x0000000001180000-0x0000000001782000-memory.dmp