Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
25/04/2026, 16:03
General
- Target 2026-04-25_52aeacd3227f7b1284072390df7a8d0a_elex_mafia_stealc_tofsee.exe
- Size 412KB
- Sample260425-thrdbacz9v
- SHA256 5e62593bc00b5f85ec82ccaa4310b0e129daabd4edb130b201166b5ee4da659f
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-04-25_52aeacd3227f7b1284072390df7a8d0a_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-04-25_52aeacd3227f7b1284072390df7a8d0a_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1B92.tmp"C:\Users\Admin\AppData\Local\Temp\1B92.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-25_52aeacd3227f7b1284072390df7a8d0a_elex_mafia_stealc_tofsee.exe D2BF33FE98E7B117F877D4A542860ACE4AD2F1F70DC90EE849B974AF11E8E40A308203CBE2A86BCA968A1CF291240155F91795E854F728CEA5C1C9F6A13DDE302⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1B92.tmp
memory/2620-5-0x0000000000A50000-0x0000000000A75000-memory.dmp
memory/3420-4-0x0000000000BE0000-0x0000000000C05000-memory.dmp