fd1e1a5185705c88e3bb9add464645c2e333b3ec1ee2b0a7abd68995f873d1fa

Analysis

max time kernel
149s
max time network
130s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
07/05/2026, 12:35

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-07_78d9ef5fdf881b48064b34c014462826_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260507-psfmcad12w
SHA256 fd1e1a5185705c88e3bb9add464645c2e333b3ec1ee2b0a7abd68995f873d1fa
MD5 78d9ef5fdf881b48064b34c014462826
SHA1 fee649a74a8088d8067a20ecc5dcfd3b10f3d137
SHA512 9ad1cd4eaaf01ca8111a23886df4240ed309bfa86204e5a2fbf828a76fe56b542530f39978b6814494d01f4ab03226a04086564cea4bace485d0d30f8c7b9366
SSDEEP 12288:U6PCrIc9kph5Its0IZrGeAagVgh611Xh:U6QIcOh5as9XAaIu61X
TLSH
T1C894E0303681C077E2A306358AEADB66293E3E754721A8D737D467AE6E712D1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1016	CF56.tmp

Executes dropped EXE 1 IoCs

pid	Process
1016	CF56.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-07_78d9ef5fdf881b48064b34c014462826_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CF56.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1016	CF56.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 1016	2776	2026-05-07_78d9ef5fdf881b48064b34c014462826_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-07_78d9ef5fdf881b48064b34c014462826_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-07_78d9ef5fdf881b48064b34c014462826_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\CF56.tmp
  "C:\Users\Admin\AppData\Local\Temp\CF56.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-07_78d9ef5fdf881b48064b34c014462826_elex_mafia_stealc_tofsee.exe 7C7918CA024B70E447094E2C4318AA2C115FB31547F0DB93C3CAC3F31BF394372AB1C65CFE5E9B46AFEBA39E6213E4251CA1AA5437753835E17892D151A48DB2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1016

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

CF56.tmp

Path C:\Users\Admin\AppData\Local\Temp\CF56.tmp
Size 412KB
SHA256 fc1204050d2f7b6168d0800247bd294b3d2316063f2e38dd98e1d9cc368e0301
MD5 02cb74de2888d2cbf22f74e23e7db8e5
SHA1 3dd003b13309400b1de71f0ee10c0c67b7d42eff
SHA512 4bc951ebdde382b7b0b9750f03258e47aac8493171bc659924f81665d56ccfdb4f7b40a74cc7ff93b32deb457604ca72d724c2e5666cc7be78079400287402ca
SSDEEP 12288:U6PCrIc9kph5h8GHu9VLpkRouCI2Zkpn49:U6QIcOh5hbHu9leRob+
TLSH
T17594E0243685C037E1A316319AE6DB661A3E7D755B22A4C73BD427AE1E703D1EB38307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1016-5-0x0000000001500000-0x0000000001525000-memory.dmp

Download

memory/2776-4-0x0000000000BC0000-0x0000000000BE5000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads