af04880d6129383428c1f641bb4d86a2a42af0f105da59565dbb7c51dcb702db

Analysis

max time kernel
149s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 01:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-08_ad1fb077714da7ae843d1ce15c720a45_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260509-b2rt3shv2w
SHA256 af04880d6129383428c1f641bb4d86a2a42af0f105da59565dbb7c51dcb702db
MD5 ad1fb077714da7ae843d1ce15c720a45
SHA1 e48e9dd3bc4b091ed47c95e74da93a9aae8be781
SHA512 2a66c50cda95293e9f106094b1e9915dd3fb660e0cfab980d5c6e422719069eae7290930dc2f86a22dec7422173748bbdc57ee42fbed8c3fdc5f909f81d1b7b2
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHQmZOgSbzbfJ7Oxno57u+BlgIkxFK5vuBZ:Zm48gODxbzWmkgSjfCg7u6PkHK5kZ
TLSH
T18484DF247581C037D19702318AF6EB615A3B3CB28B6468D77BE47B699F713D2A73420B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3608	DE5A.tmp

Executes dropped EXE 1 IoCs

pid	Process
3608	DE5A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-08_ad1fb077714da7ae843d1ce15c720a45_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DE5A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3608	DE5A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2744 wrote to memory of 3608	2744	2026-05-08_ad1fb077714da7ae843d1ce15c720a45_elex_mafia_stealc_tofsee.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-08_ad1fb077714da7ae843d1ce15c720a45_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-08_ad1fb077714da7ae843d1ce15c720a45_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2744
- C:\Users\Admin\AppData\Local\Temp\DE5A.tmp
  "C:\Users\Admin\AppData\Local\Temp\DE5A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-08_ad1fb077714da7ae843d1ce15c720a45_elex_mafia_stealc_tofsee.exe B8DC9DB1A0310B355EAAC615FD7769F67D53DF10A0182854DF573E69D8AB7474E3DC36C67FD92D130E3244ABC0DF259F1A41DC27692480186F701668800D2186
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DE5A.tmp

Path C:\Users\Admin\AppData\Local\Temp\DE5A.tmp
Size 384KB
SHA256 f4bfc1e6e4ac5f9ddee22242768c3f42a4299d548a27739adb0b115f9ba4a8f7
MD5 268a6f9fec29c5d0e23d329e3793fde9
SHA1 2e6d886dbb8108972ea01e6f39da386e573ba3af
SHA512 df712d9ac2f205a27f650ba83a34db21d1d0bc664617daf85d31e0e5eae64f3f565cdcebbc739129f21cd571d158f1b6305e4d4bc614de46770d80ce5da0e92a
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHj7y2NVG8D+ivgoZ6qjL7aexQueSD6Z:Zm48gODxbzM8qCjLB+Lc6Z
TLSH
T1FA84DF347581C036E19701314AEADB71193A3DA28B6178C77BE47BAD9EB13D1EB3424B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads