4d19b8adf1f40be87c0b4607e03d2acbd28c85e2e7e5bf41a1b83ce89dccc86f

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
25/04/2026, 16:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-25_cfde0ae1d337e3fe10bdb19b9a6f80b2_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260425-tmlnmafw2j
SHA256 4d19b8adf1f40be87c0b4607e03d2acbd28c85e2e7e5bf41a1b83ce89dccc86f
MD5 cfde0ae1d337e3fe10bdb19b9a6f80b2
SHA1 2c01a91aa3c405ff2445120e3e9cd9f4a1abd2e8
SHA512 4f0475b369672f2649cb79c2dbd61037227056caa57a945e264feae724b51309f37d834a2b6727cc66a65dc358a4554cbe01d5c0a8c47179498d37567bab2b4d
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hH3ws+ElsJFTdXp0f1Mt3LmrdXVAe6KJ2OidRLhZ:Zm48gODxbz7sTdZ0NmmrJVA7KjyRlZ
TLSH
T10684C024B580C033D19705314AF6EB215A3B3CB29B6568C77BE47B6D9EB13D2A73421B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3972	C7E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3972	C7E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-25_cfde0ae1d337e3fe10bdb19b9a6f80b2_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C7E.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3972	C7E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5184 wrote to memory of 3972	5184	2026-04-25_cfde0ae1d337e3fe10bdb19b9a6f80b2_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-25_cfde0ae1d337e3fe10bdb19b9a6f80b2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-25_cfde0ae1d337e3fe10bdb19b9a6f80b2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5184
- C:\Users\Admin\AppData\Local\Temp\C7E.tmp
  "C:\Users\Admin\AppData\Local\Temp\C7E.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-25_cfde0ae1d337e3fe10bdb19b9a6f80b2_elex_mafia_stealc_tofsee.exe BA4AC022139E5C87866234F494342DE78A3AB5059970EFBBA0D73B834C824A89C9886AD748467CFB236F5D79C8D353EA6CE198BD7D319A29CC5F67C0B61507E3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3972

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C7E.tmp

Path C:\Users\Admin\AppData\Local\Temp\C7E.tmp
Size 384KB
SHA256 466ff1439a0c347ca5706cf95d63eb7a38648ed602c79b6d93423370b6ab7215
MD5 e13718c9bf2fed4fc703294d4e947754
SHA1 48d2ea260a3d722f5ab4e87b320b1552f5911c84
SHA512 56aa399d3cbdff80f7b15289fcb6bd8b551268e8fa3ccacf55a0bd953fd5b43a01a89dece40932e8724d7a0db2f7756f794f0e16ef0b7b7d07cb2cc7186d8cce
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHRptgEXcCJAiO2BklB+USrXZ:Zm48gODxbznzgEXhBk2UkXZ
TLSH
T13084DF387581C032E19701314AF6D7622A3B3DA24B6568C77BE47A6D9FB13D1A73834B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads