013b2efee03be0a3026ec1c0c2aba0177d6587890c14f267752367ebccb697fc

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
09/05/2026, 01:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-08_7e74cf15bf5296ce808059e6f0c058c8_elex_mafia_stealc_tofsee.exe
Size 413KB
Sample260509-bc3kaagy6z
SHA256 013b2efee03be0a3026ec1c0c2aba0177d6587890c14f267752367ebccb697fc
MD5 7e74cf15bf5296ce808059e6f0c058c8
SHA1 ce8da29ebf4e358533d30c2ea4a6ca888897497e
SHA512 57f0bbe675aabe3d7b9f105b87f1df3a8a873713a1047e85c5825c6ec400aebcf1b4a98f4927421a4e870bd5c4c600975c98f5b6c1121b735de9c166be5a454b
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFff9yIH2KAgUaizL3CJIlqHg:gZLolhNVyECf9y557fhlqHg
TLSH
T19594DF25B281C036D59701318BE6D776293A7DB15B6168C7B3D83B3E1EB03D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2160	E908.tmp

Executes dropped EXE 1 IoCs

pid	Process
2160	E908.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-08_7e74cf15bf5296ce808059e6f0c058c8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E908.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2160	E908.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5704 wrote to memory of 2160	5704	2026-05-08_7e74cf15bf5296ce808059e6f0c058c8_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-08_7e74cf15bf5296ce808059e6f0c058c8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-08_7e74cf15bf5296ce808059e6f0c058c8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5704
- C:\Users\Admin\AppData\Local\Temp\E908.tmp
  "C:\Users\Admin\AppData\Local\Temp\E908.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-08_7e74cf15bf5296ce808059e6f0c058c8_elex_mafia_stealc_tofsee.exe 7459AC9F505DCC560A4DF4C7245275282BF45D09C547BCE4AFF7C7FA77761CB1D507068324FE15B1C2B6963A35B98BBA616B446F2A0F28151E44E671DE7AB78E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E908.tmp

Path C:\Users\Admin\AppData\Local\Temp\E908.tmp
Size 413KB
SHA256 e88b3b5f47c92f15c028b8ddddae89cfc7294be471d0fbcd05cceff7b1598035
MD5 1ee9a5ffc5d55996cf5adec758b9bdbc
SHA1 c51440e915adafba2dbf962688e1dc5551b776d0
SHA512 7b152d38496d61c4712bbd0b8b2635db3956aaef849ae99ccc868b71b2149189aa1775649dc0a904d6bf27977037f3269d505cc2c15762bf96f1beb6a97ea72b
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFr/lj427lZZeB3p9Eli5mwkxi2M6vozSjqHg:gZLolhNVyEuWq13XwgM6voGjqHg
TLSH
T12494DF29B2C1C036D09301358BB6DB32553A7DB15B6264DBB3D83B6E1E713D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads