a46159d5a168a5ed1434bdf3377d629a06ff4d0f8bb045ce53f58d4583f17d60

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 09:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260503-k3ltwset8x
SHA256 a46159d5a168a5ed1434bdf3377d629a06ff4d0f8bb045ce53f58d4583f17d60
MD5 9db23b8e55d34098abccfd12838b1b26
SHA1 f628dc009c9ca5f920bde833e1a4ce1d5a587eb4
SHA512 209b36cd80f77ec1bdffc6a8bbe1fd98bd9c961a8a43f1b449324adc32649a9d4e5294586cefcae75b71639140f2d87408da3180a7696aebcf1b5cf48fe64c7d
SSDEEP 12288:Nb4bZudi79LrCZK1FQAA239pNKa4+6TZZKIA0a:Nb4bcdkLrCZ2ywtpUaZ6C7
TLSH
T19DA4E1243692C037D15616394AE6C7B5667A7CA19F72A8C73BD03BBD2EB02D1E630347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3772	271B.tmp

Executes dropped EXE 1 IoCs

pid	Process
3772	271B.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	271B.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2552 wrote to memory of 3772	2552	2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2552
- C:\Users\Admin\AppData\Local\Temp\271B.tmp
  "C:\Users\Admin\AppData\Local\Temp\271B.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-03_9db23b8e55d34098abccfd12838b1b26_elex_mafia_stealc_tofsee.exe FCC577AB6381833F0BC4B23C5B6B9927F5CAD0774C8D90E7D1181D1FB73DBC68BA1DBD492665DCB6BFD7FF2EC3E250BF941FF52275CCED986BE59D2FC7EF6ABB
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3772

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

271B.tmp

Path C:\Users\Admin\AppData\Local\Temp\271B.tmp
Size 473KB
SHA256 4ac0f3048969e3e46ec1646391ee5b8d855426bdbeda38a8bf1843c6cede1ad5
MD5 c5f4e1069d34f455e9904293f5a63578
SHA1 99d538d39d24c2adf2b5d974c04c9db184418117
SHA512 7c9cb6a50aa8d3ec1ef52a7c6e3da9c4a222f6d5561f49ed88fec58041566bd437e93801a1d5f5c9fd72072c19ef2c6b0757936222f08c19872beac5d92f0c9c
SSDEEP 12288:Nb4bZudi79L/2lknEXm6CfnjbAbqLLOjLA0a:Nb4bcdkL/2eEPCfPWSr
TLSH
T104A4F1253081C037E2A716394BE5CBB5653A7DA15F6128CB3BD437AD6EB02E2DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download