02706ab54be114f8123e4d25a5dacc1275339faa3bd0fcf0b03199663b55a327

Analysis

max time kernel
149s
max time network
158s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 13:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_35d1505f2856cacfbdfe37e8d602b2fd_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260506-qs4jvabz21
SHA256 02706ab54be114f8123e4d25a5dacc1275339faa3bd0fcf0b03199663b55a327
MD5 35d1505f2856cacfbdfe37e8d602b2fd
SHA1 b8e12f76a0dd4476aa570c0f13f8e434250653aa
SHA512 2c246b0dfe690f0f6e6786ece0bc0dbebbe763c39cb26b97551aa06b7e06dde99d550031e0fb2c547e8c33a669e2481a1067e6af96f9f2c1d78b501ee013eb76
SSDEEP 12288:bO4rfItL8HA+yN0QfOi1R6YkBgp2NE1cSswnrA75UO:bO4rQtGA+yNfvR6Y2N25swnrAVUO
TLSH
T126A4E02A7681C133D2D302300BD6D7AAA63E79B54726A4C73BD4027D1F626E1D77A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2504	28A1.tmp

Executes dropped EXE 1 IoCs

pid	Process
2504	28A1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_35d1505f2856cacfbdfe37e8d602b2fd_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	28A1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3080 wrote to memory of 2504	3080	2026-05-06_35d1505f2856cacfbdfe37e8d602b2fd_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-06_35d1505f2856cacfbdfe37e8d602b2fd_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_35d1505f2856cacfbdfe37e8d602b2fd_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3080
- C:\Users\Admin\AppData\Local\Temp\28A1.tmp
  "C:\Users\Admin\AppData\Local\Temp\28A1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-06_35d1505f2856cacfbdfe37e8d602b2fd_elex_mafia_stealc_tofsee.exe 43948663BAD557913275347E71A624B5B9A56A744AB55215EA10DBE0058286EF8F54A64E023BDA1F54A6037F0A42D82B263D3ED527A279479C04DB79D56C6B4A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2504

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

28A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\28A1.tmp
Size 479KB
SHA256 cf27d833200b6f1d8367fa286cddbfb1a3117c2c3e56b4b2e6d2560f0468c4f9
MD5 63154864eaeb02d7cc271d6383b98991
SHA1 faf81f6d6866b164e859ade7be6cb65d15a40bf6
SHA512 d30aab7148baaa958f4789cd75b81880e13cff3133f77d43ea68fadefd0f54c8890000a182e9f4bb04afb545b6a3054b62521e9d3303b2dfe6e55b70e6784484
SSDEEP 12288:bO4rfItL8HA+uKZKLROOFuHXSv8J3UqAfVTpm75UO:bO4rQtGA+ucKl7FwS8JDAfSVUO
TLSH
T1C3A4F12AB741C033E69302B10FDADB9AA73E7974476690C72BE8026D1F616D1D37934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download