1ecc37ae3b46ac14d3e1abeb58ba6af4551a55d2c62832984489910ca08938ae

Analysis

max time kernel
149s
max time network
92s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/05/2026, 01:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260504-bthlfaaz7s
SHA256 1ecc37ae3b46ac14d3e1abeb58ba6af4551a55d2c62832984489910ca08938ae
MD5 00b72ae810050df99eeef65c42a2a24d
SHA1 f6d735f1e6cd8b8dce47c249f5698c047c6c43ba
SHA512 4a6267c696ce47fbe1403e4bbed3ae93da89788227f1a11c30284f07d5da6d6a4756fe333ff9e90a456d29bc393e539774f2efae14335cadd80cbf099f26448d
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYDxrNt+qbcTnhBv6NklaJG23mHT7ANxel:Wq4w/ekieZgU6A7+qbcTnDSWINxel
TLSH
T11794E0303681C037E1A715348AE5CB6A297EBD744B36A4C73BD02BAA6E742D1D73531B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3364	1076.tmp

Executes dropped EXE 1 IoCs

pid	Process
3364	1076.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1076.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 3364	492	2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:492
- C:\Users\Admin\AppData\Local\Temp\1076.tmp
  "C:\Users\Admin\AppData\Local\Temp\1076.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-04_00b72ae810050df99eeef65c42a2a24d_elex_mafia_stealc_tofsee.exe 36F2048E2354204669F1C70E4050957BD730ADCD969798BCC70D6A3C52FD3FA37F3457FCA199B1385342B5BBCE860C48DA275B2D522E56AD7A50657979F1CC05
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3364

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1076.tmp

Path C:\Users\Admin\AppData\Local\Temp\1076.tmp
Size 414KB
SHA256 968539107330264fc6173c712e7ea2bb0a71dc187d8d5eae0748ab6dc8bdb5ac
MD5 a5649f2c23ac14e7f84866043a1ab9a9
SHA1 f703352f4f144f869d647fd59d1b714c178158d7
SHA512 9e3a1d22b55fa60375c5807fa33077ed5b8626f784bd619f9c198935b9d44366eb29143d66a0c0802362bd2b961d0e4ed2c42c30d20d5d6d4702f61b45090e66
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYv9j4oMAVVs6CJbUxBPkgt8uiWESujxWSeXl:Wq4w/ekieZgU6KMAXs6KUxrM8rXl
TLSH
T1A894E0307586C037E5A715354AF1DBAA6A2A3CB14736A8C73BD42BAE6E742C1D734307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/492-3-0x00000000009D0000-0x0000000000B7C000-memory.dmp

Download

memory/3364-5-0x0000000001810000-0x00000000019BC000-memory.dmp