d40e35be7b166293cec5821fa992be1a27b7a5686ca857f8a0caa8621ff07e3c

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/05/2026, 15:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-05_a7227c2066c022efc35385f3ed826f59_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260505-senycaev2p
SHA256 d40e35be7b166293cec5821fa992be1a27b7a5686ca857f8a0caa8621ff07e3c
MD5 a7227c2066c022efc35385f3ed826f59
SHA1 d9152534efe3159ff975cdd6ed3bb838796fc818
SHA512 e06162e1fef35426f1362d4603d2e6b09e387b14d0cbf8503ebe42411ef1b93c780e78c94636b9441f4871c2a6ea420e5d8dbd53000f7825d111192e09306205
SSDEEP 12288:Nb4bZudi79LIRUfGlvKm7OtJ1hFy129o7OPA:Nb4bcdkLI2fqvlqH1hro
TLSH
T143A4E1243581C037E2A715394BE6DB75693E79B14B22A8C737D01B7D2EB02E2E634317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2396	FDA.tmp

Executes dropped EXE 1 IoCs

pid	Process
2396	FDA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-05_a7227c2066c022efc35385f3ed826f59_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FDA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3440 wrote to memory of 2396	3440	2026-05-05_a7227c2066c022efc35385f3ed826f59_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-05_a7227c2066c022efc35385f3ed826f59_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-05_a7227c2066c022efc35385f3ed826f59_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3440
- C:\Users\Admin\AppData\Local\Temp\FDA.tmp
  "C:\Users\Admin\AppData\Local\Temp\FDA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-05_a7227c2066c022efc35385f3ed826f59_elex_mafia_stealc_tofsee.exe BD967EE62B1BC431974D2BA24EEA943936FD2A6BC7C1D2BE495161893FD6F065131930BDB48FF0144E27F606793D691975A8DB10BE1B6B66E7A243773E1D956E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FDA.tmp

Path C:\Users\Admin\AppData\Local\Temp\FDA.tmp
Size 444KB
SHA256 c80d31f27b66b70e1fa38ab02b4ecc79c4a311a660fa449fad37db55acd4aec9
MD5 dd07d33fe51c09c1111d4318d5361ef4
SHA1 168f316e68d3c31163c76c51852f1cfc77e53906
SHA512 5388d20d7a64fde4e6877be00ddb9482ece9b61a75002497ba8f9613da3b8d97a15d4d57ed1dc626525d50ca62eab22fd7d1682ac319025148852a2b35802ac9
SSDEEP 12288:Nb4bZudi79LZTjLWvQMWuy1xJNF6dRmCNHmY+A:Nb4bcdkLZnKDWuyNF6pNH/
TLSH
T134A4E0203581C037E2A316384FE5DBB669797DB14B6668CB37D42BAD1EB02E1E634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download