f4d913458fa951dcc997bcac27e2e3760d44a06183cb5b46b9fb15815112e634

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/05/2026, 15:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-02_0986ff36f70ebf122ecd1c037b6fe956_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260502-s6y8dsbx2s
SHA256 f4d913458fa951dcc997bcac27e2e3760d44a06183cb5b46b9fb15815112e634
MD5 0986ff36f70ebf122ecd1c037b6fe956
SHA1 dc5443592988a8ee717db949d228104a201e5e84
SHA512 d04a00a55b7c7053fadc083408c18021d28ce6e084c0e788f990e73081c11ed1957379af01d769e347c1038a7c24f06bcd915a1a85005c79a9c0420e1b065ccc
SSDEEP 12288:Ci4g+yU+0pAiv+1ZpJB4cr3DmBMUeInx/T2juon:Ci4gXn0pD+zD283alJnxKjP
TLSH
T1D494F1313182C033E2A715748BE5DB66667E79B1472278CB3BD00B7E6E642D1E63439B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1520	1095.tmp

Executes dropped EXE 1 IoCs

pid	Process
1520	1095.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-02_0986ff36f70ebf122ecd1c037b6fe956_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1095.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3240 wrote to memory of 1520	3240	2026-05-02_0986ff36f70ebf122ecd1c037b6fe956_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-02_0986ff36f70ebf122ecd1c037b6fe956_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-02_0986ff36f70ebf122ecd1c037b6fe956_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3240
- C:\Users\Admin\AppData\Local\Temp\1095.tmp
  "C:\Users\Admin\AppData\Local\Temp\1095.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-02_0986ff36f70ebf122ecd1c037b6fe956_elex_mafia_stealc_tofsee.exe F9B9A31C0C1288DAE8609F3C1BE2A9D784B348891E6BF8E03FD8BBC47FFDFE5854A256DE53F54926BBA010BDC227CD36365D72C1F8A023763C64E52E53285364
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1520

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1095.tmp

Path C:\Users\Admin\AppData\Local\Temp\1095.tmp
Size 433KB
SHA256 d2959c267367ee9025dcf2712d624be9797a8a83901a7a91b8a1f5a1f07f1c01
MD5 e28865e31734e5759afe6aa0eccf963e
SHA1 aa7d240a5a4bd4dc97afb309b8792a37f916f2eb
SHA512 5ce5d7c0aeda2d0194dfb2dbc571964fcb93b80eea545deb3589a744dd98800d1f0c217d59c728bea0fe04b3f9ffa6eec568eddf59e4f3ad7fb58d18a1a137f6
SSDEEP 12288:Ci4g+yU+0pAiv+xWRKdU4YPvbfM8TFZiDV5fWUUX4ofFlO6n:Ci4gXn0pD+x9YPTM8TF4B0UUX4o9lOq
TLSH
T1BD94F1213582C033E1A715348BF6CB6565BE75B10B16A8CB7BC81BBE2F602E1D27535B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1520-5-0x0000000000A20000-0x0000000000BCC000-memory.dmp

Download

memory/3240-4-0x0000000000CE0000-0x0000000000E8C000-memory.dmp