e8236b93064551d338d14808d2e594dacf7f23f8055e0baaccd2783015787431

Analysis

max time kernel
149s
max time network
161s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 02:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260425-ctfbracv7s
SHA256 e8236b93064551d338d14808d2e594dacf7f23f8055e0baaccd2783015787431
MD5 67fabb78d4664bca826ab8de707ed021
SHA1 46d61a29d176c1c9ac52f209e665ac3e3842b2d8
SHA512 88c6b50774bfa2e0adf4ed0e47fe9d81f8262358eb5ec48b953676372e9558adcf8d2383f0d5399c7f66b38ffa30871d4e8c32ef481696b0bc0455db6ce493cd
SSDEEP 12288:bO4rfItL8HAH+Uaf5EBfqGhkZs6XSWf875UO:bO4rQtGAHrahEAfZAVUO
TLSH
T19AA4F1397681C133D29302754BEADBA9B63E75714736A4C36B94027D2F61AE1C33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1068	1F5A.tmp

Executes dropped EXE 1 IoCs

pid	Process
1068	1F5A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1F5A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4968 wrote to memory of 1068	4968	2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4968
- C:\Users\Admin\AppData\Local\Temp\1F5A.tmp
  "C:\Users\Admin\AppData\Local\Temp\1F5A.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_67fabb78d4664bca826ab8de707ed021_elex_mafia_stealc_tofsee.exe 96707B3597CC99D957D9FAF44789DEE1921FB4A0960F6E26EC4B07835B5A57BA97167A8567B4E1266CD8C82FE6CE10F4E749F9E16C60B6808DAC962F977A75B1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1068

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1F5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\1F5A.tmp
Size 479KB
SHA256 f0302d5541d91733eb287a968cc9ab9383e5b8e578edabd616e5f0fa496e01b1
MD5 dd55f4be6a63621b29c177ab868ada51
SHA1 ed89341758694b107aae4751550a255e5d485a1a
SHA512 2da0006a2ebf7d430926c8c547fb135116189b62e9ef969cb8a84f0b0454e928fc488af0f6ffd003a103fad99c8e3ded123b7660ca9489d64afc622a64bce2c3
SSDEEP 12288:bO4rfItL8HA5L5mTVNyRW7friZS2dyPTTI75UO:bO4rQtGAN5mTVhTr2dyPT0VUO
TLSH
T118A4E12A7381C133D29302755BEADBAA663E75701722A4C377D8067E1F616E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download