Analysis
- max time kernel
149s - max time network
93s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 01:10
General
- Target 2026-05-11_c13a0ca2ac7fca5c8f95fd5519a36674_elex_mafia_stealc_tofsee.exe
- Size 384KB
- Sample260511-bjcmfacv4p
- SHA256 1d9e73c309e5ebad42be526e986e72d94fd03843284ba6eeff8ba506b0d7125a
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs
Adversaries may check for Internet connectivity on compromised systems.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_c13a0ca2ac7fca5c8f95fd5519a36674_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_c13a0ca2ac7fca5c8f95fd5519a36674_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10A5.tmp"C:\Users\Admin\AppData\Local\Temp\10A5.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-11_c13a0ca2ac7fca5c8f95fd5519a36674_elex_mafia_stealc_tofsee.exe 952E57F1B9C008C03A1F881B4E934ED294D088304F33FD5B22E6D5B1354CB7AB93039D481DBD603C8CF44252F61BFFF2CFEE1026D5735F232C3AB91C95F317642⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
10A5.tmp
memory/3560-3-0x00000000013C0000-0x000000000156C000-memory.dmp
memory/5384-5-0x0000000001080000-0x000000000122C000-memory.dmp