0e4e51b0a2bb3c02598ca31bc3377c6d72a92e21db6b89c7eec7ddc1f93d1a2b

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/05/2026, 12:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260503-prp5dshv2w
SHA256 0e4e51b0a2bb3c02598ca31bc3377c6d72a92e21db6b89c7eec7ddc1f93d1a2b
MD5 d7fe940e37d042f5e732d466a4660c54
SHA1 3edb750e011e50116da906c76845827fb2322847
SHA512 4b0cc3f10a57ed5addbd2cb1ad1d12feadcecd9c47b89e5eca7190f008a0d879a49747f2c42e44ded95d221c00c54523f80b266162b959ea6b6eae240d9c64d5
SSDEEP 12288:Nb4bZudi79LMJ1n3N1zFEaXjqnGxEe6EyLwKXA:Nb4bcdkLAtDiaFxE
TLSH
T186A4F0243582C037D2A706354BF5C776AA3E3DA14B2268C737942BAE5EB42E2D374347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6100	F4EF.tmp

Executes dropped EXE 1 IoCs

pid	Process
6100	F4EF.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F4EF.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 6100	4216	2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\F4EF.tmp
  "C:\Users\Admin\AppData\Local\Temp\F4EF.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-03_d7fe940e37d042f5e732d466a4660c54_elex_mafia_stealc_tofsee.exe 35C06A7BB040F9CF1B11694F2EC6DEB63D4DCECFEBA8C5B234A343E1517348F52136FF48D6D6E9607ADF87862EC738E84EB632E40F2ECF35EE4D0629C6405C4A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6100

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F4EF.tmp

Path C:\Users\Admin\AppData\Local\Temp\F4EF.tmp
Size 444KB
SHA256 9545d40c6e0accb5454be115c754da46718d7247017ea8e468d6def59a6a92e5
MD5 f94ac79c6e9a397ce1002b88df49a7f2
SHA1 0e6fa6e70f3c5cb68e725fb20da27f7467bf7751
SHA512 6e7bd90251ae07b6afb9471bf0ad0938769ce3fbd30d6ce9099bd31248cbd2ed257de01e92ff98d7d92edafc0ed6163e40f2533bcd570aac5042ffc8c2a761c8
SSDEEP 12288:Nb4bZudi79L/LGB9c1qa0RNPEX8A/T0rA:Nb4bcdkLKB9OqaaNsXj/T
TLSH
T1A0A4E1243686C037D29711384AE6DB75553E3DA14B2668C73BE067BE6EB02E2E634353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download