df42688bc2e69a2076ebf06cee389c0a508b21cffcb9d081be7e532c1c51661e

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 03:43

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260425-d94vqaev7y
SHA256 df42688bc2e69a2076ebf06cee389c0a508b21cffcb9d081be7e532c1c51661e
MD5 be1e3d6a19a0670291069a0593cfc270
SHA1 0e77c155e9475f8d1f7d611a1dd2c45b1c9478be
SHA512 40536846c31047da06d20e3d0e120a55829669f43eb8786a64b41e37ba27ecf2254decff3644dfe46bb7b559fdee3c1c42655906145b811526d29a6c0d8ab9cd
SSDEEP 12288:qO4rfItL8HG7rx9jAJ5TM2yvwgsXV3Z7bWmeEVGL:qO4rQtGG7rXjA/XCwgsXV3ZumeEVGL
TLSH
T187A4F13A7241C133E29301711BE6D76AAA3E79B50726A4C33BD8067D2F616E1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4024	EC06.tmp

Executes dropped EXE 1 IoCs

pid	Process
4024	EC06.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	EC06.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3144 wrote to memory of 4024	3144	2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3144
- C:\Users\Admin\AppData\Local\Temp\EC06.tmp
  "C:\Users\Admin\AppData\Local\Temp\EC06.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-25_be1e3d6a19a0670291069a0593cfc270_elex_mafia_stealc_tofsee.exe EDB9B97984DD5F12D11559C05191205AA111601E145A3CB69715E91C950774CC7C73F242AE574825DF7B8EED0B7F555233FA705CA77080C1A2EECD7FAEE4DC79
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4024

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

EC06.tmp

Path C:\Users\Admin\AppData\Local\Temp\EC06.tmp
Size 468KB
SHA256 d2ba3b4bf0d22a0d326a69482beef27058a005bc3c277c28722c0fd15703e977
MD5 d4dbbf7cb447a5b454e61ae83f6a11c5
SHA1 707caaebbcb246409082d363b0963bb5007081a8
SHA512 c29f2f06bbb798c4f85a1de058d2a4a3ba063ee11e16c706c657e8dde70c65e0807d885d7556fca3b2ef8cea468a4d243f5c85c9c91a13aa9a6e9567e2d46acb
SSDEEP 12288:qO4rfItL8HGj4w9OBAySuabr1K9v7bWmeEVGL:qO4rQtGGcwsAySbZ4vumeEVGL
TLSH
T1EAA4F12A7641C133C29312751BEADBA6663E79B00762A4D33BD8427E1F657D1D33A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download