54de309ee71aabb14c7a7667c969fc5600e0b2199f1f46a8353d65c069af542a

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/05/2026, 14:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-06_bcb7d9f211c3725aaeb7ffaf95672900_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260506-rtbe5acy8s
SHA256 54de309ee71aabb14c7a7667c969fc5600e0b2199f1f46a8353d65c069af542a
MD5 bcb7d9f211c3725aaeb7ffaf95672900
SHA1 33dbb57cb437de23ef37a629a5d6be4fe9e2a23d
SHA512 a81a77d1aee16a699cdb3af6a5ccfc4980d7faf40f1abd9c69cec7bc2f2ec12c60dd3d8c0cbba0bf6d5581e67222e450ac52fede39a5f1ab67fd45a753507d47
SSDEEP 12288:Wq4w/ekieZgU6xUxwdH+uT3QfUCp2B7KJHOlx:Wq4w/ekieH6gwdH+uTAfUCp2UJur
TLSH
T1A994E0353482C03BE1A305348BE5CA69593E7D658B3AA8C73BD42BAE5E742D1D73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1256	1A1.tmp

Executes dropped EXE 1 IoCs

pid	Process
1256	1A1.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-06_bcb7d9f211c3725aaeb7ffaf95672900_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1A1.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 1256	2352	2026-05-06_bcb7d9f211c3725aaeb7ffaf95672900_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-06_bcb7d9f211c3725aaeb7ffaf95672900_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-06_bcb7d9f211c3725aaeb7ffaf95672900_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Users\Admin\AppData\Local\Temp\1A1.tmp
  "C:\Users\Admin\AppData\Local\Temp\1A1.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-06_bcb7d9f211c3725aaeb7ffaf95672900_elex_mafia_stealc_tofsee.exe 78C7B8155B5B9FE50E53D9AB6B64319FFD5E9F8B8B56D773089EDB465767C1B1B3C2675F2EBA3AEF8D483E253CEA635D080AB4433FBBC9A50764694EFF0E35EC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1A1.tmp

Path C:\Users\Admin\AppData\Local\Temp\1A1.tmp
Size 414KB
SHA256 d40e9ecfbf86fedd5d416bc807e92becd5f246c744cb62e4e4a5eb1af9282941
MD5 44c5fca7e6145f0cd51d04ed9a903816
SHA1 40f4158d6d9e19d427328a84bcfaddad522c4164
SHA512 fc08b05f8641848cfec26a8edc62f83f0b92a80734c2948a22ff1c78eaf79c23de28e3e52125fd5a2f9d4a45e9d3d090b85caa7222c7397edd4de4e87694b471
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYeyJ6lH125Bm2rG8dlbiVclYlx:Wq4w/ekieZgU6Vm6lcn7LiiYlx
TLSH
T1E794E0317182C036E19706358BF8DA79697A7DA44B36A8C73BD42BAE5E742C1D73034B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download