e90723fc80df835dcada3779fb751defee0aa4af96fd6a0a3f96cff397bf6b86

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 02:22

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260425-ctr1jscv8t
SHA256 e90723fc80df835dcada3779fb751defee0aa4af96fd6a0a3f96cff397bf6b86
MD5 3b262b135faacd3c6bd92337fff28022
SHA1 1412ceadacca0fb7a1a226e3ae1ac841823f2588
SHA512 687e98f3d23889986755bbcc7684957cfdbe5a7a5492b3421772ac39d3103968f44ecbb57cd85344118d366e372ff7ca4e3e53c96e7a7dc2262330260fd99c6c
SSDEEP 12288:Z594+AcL4tBekiuKzEr5OKTr23ISbbSawWrsFaNA7Ifl:BL4tBekiuVr5UZfSjWIF0
TLSH
T1A994F1353581C033E29622344BF6CB6A197E79A24B2678CB3BD41B6E5E643D2E735307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3356	1E22.tmp

Executes dropped EXE 1 IoCs

pid	Process
3356	1E22.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1E22.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1792 wrote to memory of 3356	1792	2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1792
- C:\Users\Admin\AppData\Local\Temp\1E22.tmp
  "C:\Users\Admin\AppData\Local\Temp\1E22.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_3b262b135faacd3c6bd92337fff28022_elex_mafia_stealc_tofsee.exe B48D61737F16D713AC33D6EB4973DA2CFC5ABA90D8EE79358A3980B60DC455A149C5A2A765B46A43E0203D7C242BE01B95F9D81CFFC9C14C08152C52549A6919
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3356

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1E22.tmp

Path C:\Users\Admin\AppData\Local\Temp\1E22.tmp
Size 428KB
SHA256 2a367b055bde51a4f1051edc99f709cbe30e8b4dc93c2d93c2e21fa888953b23
MD5 a3e7a12d6a3c1ad9ab915c1a5908f1be
SHA1 5c52ab5317dffc44735192222a664ce0994b718d
SHA512 5c01f7c9e83bee69a87d6907cf9c408e9e57edac82d7ba47b6baace35aa5e4a306fbd8475a22c2ffc793a9c3fd813bdba9a9a65dd8619fb1f511c9bf13a2075a
SSDEEP 12288:Z594+AcL4tBekiuKzErkWqci1CupLf4stl:BL4tBekiuVr9piYupLf4st
TLSH
T1FB94F0313082C033E2A715394FE5CB6A653E79B64B29A8C73BD407AD5EA46D1E73430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download