e1c7e761598404ddc912795bb3a3a505aa5698c84cfe8d3b26e5eb763a05c361

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
26/04/2026, 04:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260426-e5fsrsfw8p
SHA256 e1c7e761598404ddc912795bb3a3a505aa5698c84cfe8d3b26e5eb763a05c361
MD5 300b67955642b6a9e27b6aae3bcd8cce
SHA1 7675d0511d4ba43a43d62c66878e2c222032ab1d
SHA512 1e27505ccefeb533d5895efca2a89e28cc174919ae50b747c06ca6b39bb6f1e488ff410047bbb2518ba34631f1056f359544db3313408656b8c68bbbb9bd066a
SSDEEP 12288:fd4x+ePixnXQjBMQJPGM50RvoBJV1RTnS7DYwP:fd4x+ePixAjBLGawvoBJV1ZnQU
TLSH
T18994E0243282C037E1A206388BF5CE6969797DA40B76B4C777D437AA6E742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1800	FC13.tmp

Executes dropped EXE 1 IoCs

pid	Process
1800	FC13.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FC13.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2244 wrote to memory of 1800	2244	2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2244
- C:\Users\Admin\AppData\Local\Temp\FC13.tmp
  "C:\Users\Admin\AppData\Local\Temp\FC13.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-26_300b67955642b6a9e27b6aae3bcd8cce_elex_mafia_stealc_tofsee.exe 1A833D368C99730499842B0B1CCEFB2826A2FF4D13D015C699ACB773571009ACC4795FE14CB9D4E9630F85E027288C1A6197C6A8718405D918DB6AB09310153A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1800

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FC13.tmp

Path C:\Users\Admin\AppData\Local\Temp\FC13.tmp
Size 435KB
SHA256 374ff271a3273a347ff4b16e87e0278f83a17eb203e65c4d39b630d0072a998a
MD5 5b0673906341ee6b9785c9b8118afcab
SHA1 847512069998f71895071e121ab1ea3fdbcbbff7
SHA512 52d40b7bf2929a5e4e3c5baa56df6be521748c3a0052e9831851e9da7ece7bad7253dbea5806235808b6864fba2398ccc0ea687524a24e3a70de7e9712f3c57f
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYbb+DIP8q22pxMDBoWqdWKv+w9J:fd4x+ePixnXQjY6BuWr9wP
TLSH
T13C94E0313686C03BE2E606354BE5CBA959397D644B32A8C737D42BAE5E742C1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download