Analysis
- max time kernel
149s - max time network
150s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
03/05/2026, 12:55
General
- Target 2026-05-03_fc85744a23e376013f1b85f514e0d693_elex_mafia_stealc_tofsee.exe
- Size 526KB
- Sample260503-p5wt4acy2p
- SHA256 f01365d3f2920a47a7b7c43e81ea58f9685e1df49db86fda0f53f90841a961d3
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-03_fc85744a23e376013f1b85f514e0d693_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-03_fc85744a23e376013f1b85f514e0d693_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F898.tmp"C:\Users\Admin\AppData\Local\Temp\F898.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-03_fc85744a23e376013f1b85f514e0d693_elex_mafia_stealc_tofsee.exe F72AC32096C5957B59448B31F951E6CCBC5DD5B5D9A7375B4EB407B8F2D4A972E22BAB654658259F3BA46779EC2DF7545AD95999B816F7656D3236524096CC832⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
F898.tmp
memory/4724-3-0x0000000001380000-0x000000000145F000-memory.dmp
memory/5620-5-0x0000000000A90000-0x0000000000B6F000-memory.dmp