ec46e2e37f50738dfc1ba673d897f8d239814b7bc0c27c687b9a30c693825260

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
27/04/2026, 04:48

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-27_678ce59ab41d639da750cecac6199158_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260427-ffae5aex5j
SHA256 ec46e2e37f50738dfc1ba673d897f8d239814b7bc0c27c687b9a30c693825260
MD5 678ce59ab41d639da750cecac6199158
SHA1 d954b6ea9eb544de0ee66b7cd743ef2d41c90730
SHA512 d133e0ce46a62cd2674bac49df377459975d0b5c1b1a8235841c59bbcc4edccadca02890b945fe51996b40a1fe31b515b3edfa2474143ed8c7de6b27f0586a2e
SSDEEP 12288:Wq4w/ekieZgU6WICbCOK/XsqYS2I5lpJlx:Wq4w/ekieH6W+OKPsqYSv3r
TLSH
T1EA94E0213586C037E1A715354BE5C7AA293E7DA54B36A8C73BD42BAE6E742C1DB30307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3628	F0E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3628	F0E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-27_678ce59ab41d639da750cecac6199158_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F0E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 788 wrote to memory of 3628	788	2026-04-27_678ce59ab41d639da750cecac6199158_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-04-27_678ce59ab41d639da750cecac6199158_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-27_678ce59ab41d639da750cecac6199158_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:788
- C:\Users\Admin\AppData\Local\Temp\F0E.tmp
  "C:\Users\Admin\AppData\Local\Temp\F0E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-27_678ce59ab41d639da750cecac6199158_elex_mafia_stealc_tofsee.exe D3CD2517F207FB8A4248E1F3A447080AF557DE716774A2D74AA529022B183526EE8A2038A21925123DA9A2CA3D20C441FDEF290C129527552A07CA6544BF6344
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3628

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F0E.tmp

Path C:\Users\Admin\AppData\Local\Temp\F0E.tmp
Size 414KB
SHA256 b2836a422c200959a25e343ee19929ebac717bf82717b661a0082726c6f2d3da
MD5 ceec1016859c5fe96e3c688f86ecc88b
SHA1 169ca4df2fb369675e77758b297591a1065169f5
SHA512 aa8e54a5ac9c985c9bacb6e8694df79e45ea0fa9e34d4cebd9705295449a593690a89b65d7420c6e081905384f085d816e814bab38fe24deebe2358bd5fa56c9
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYqbi8E+SYhut0/xiZoJsMtFQX18JTFo8lx:Wq4w/ekieZgU6XQ0uoKMtFrDo8lx
TLSH
T1A094E0203586C03AE1A71A348BE5DB79593D7DA04B36A8C737D42BAE5E742D1EB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/788-4-0x0000000002870000-0x00000000028D4000-memory.dmp

Download

memory/3628-5-0x0000000002720000-0x0000000002784000-memory.dmp