8bebb9c158f91e1e702ef935f962a490082d3ace67d45241d62a4b933ddc6906

Analysis

max time kernel
149s
max time network
156s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_f239c3655be8b8d7de5b1f728dce4b29_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260506-pp3mpsaz2x
SHA256 8bebb9c158f91e1e702ef935f962a490082d3ace67d45241d62a4b933ddc6906
MD5 f239c3655be8b8d7de5b1f728dce4b29
SHA1 62b7dab23d2ff57430dc32b97abb1382cd1b1bd0
SHA512 8b61dcbaf1010ba53561abb1a7a655ff3dc5064e156f3d7bba5dcf501b05e8e228ec6437290c88dc88f1fba10cf8cc9ddad457a709b2deae2ad10837a08870de
SSDEEP 12288:Wq4w/ekieZgU6S9QyqMoz+46nP8WrM3Ll:Wq4w/ekieH6S9QyqTgPxM3L
TLSH
T15594E1213586C037E2AB16348AF5CB6955397DB50B35A8CB3BC42BAE6E752C1DB31307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1464	867.tmp

Executes dropped EXE 1 IoCs

pid	Process
1464	867.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_f239c3655be8b8d7de5b1f728dce4b29_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	867.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3128 wrote to memory of 1464	3128	2026-05-06_f239c3655be8b8d7de5b1f728dce4b29_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-06_f239c3655be8b8d7de5b1f728dce4b29_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_f239c3655be8b8d7de5b1f728dce4b29_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3128
- C:\Users\Admin\AppData\Local\Temp\867.tmp
  "C:\Users\Admin\AppData\Local\Temp\867.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-06_f239c3655be8b8d7de5b1f728dce4b29_elex_mafia_stealc_tofsee.exe 7C1FA8D8F5181446D0C0503DE5073D13C10DDCEE396F210FE96A6CB9C0CBE23F8B56D21FF3421BE3EBE477649BCBC4A2C3E5ED4D7B0F25897DD912D072EA0C05
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1464

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

867.tmp

Path C:\Users\Admin\AppData\Local\Temp\867.tmp
Size 414KB
SHA256 0606b6b58f2ab438b72d510991382d277918e14aba48a41c33a9f1b88f7cb5c9
MD5 02078a9d7d53448ff7e78200e696e10b
SHA1 a6e0f5e99957536f5d6d9d5921ac930b0691a8be
SHA512 95daba08a97221aafa1fd84a5d64659420a7441c55af9b64265aba3ebf21f0f6c42a4f123e36404f65e1cfb6ec4951d80b555931a9087369adeea9d0dc1b6848
SSDEEP 12288:Wq4w/ekieZgU640zEZwvY/blmq4DWbmE0yS2WVl:Wq4w/ekieH64NZGYQRWX0yhO
TLSH
T14794E0213986C037E1A706788BE1CAA9593A7DA44B36E4C737D427BE5E742D1DB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download