Analysis
- max time kernel
149s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 01:23
General
- Target 2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe
- Size 414KB
- Sample260511-br2arscw5p
- SHA256 814df8a0a02c026f0c48112b2fc3910799af6829af085be49a428741be7c827c
Score
7/10
Malware Config
Signatures
- Deletes itself 1 IoCs
- Executes dropped EXE 1 IoCs
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious use of WriteProcessMemory 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\41E6.tmp"C:\Users\Admin\AppData\Local\Temp\41E6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe FDE2C99C73EBF5BB18CCB61D4434A3137B12AB0B09FAFB8CB24BC4D5F661DC837F146A0B0C61796B4560A0BFCC1DD7E69E7B52FA8479C835F90C7AB5FA1933D82⤵
- Deletes itself
- Executes dropped EXE
- System Location Discovery: System Language Discovery
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
41E6.tmp
memory/3996-5-0x0000000000FC0000-0x0000000000FD9000-memory.dmp
memory/3996-4-0x0000000000D40000-0x0000000000D85000-memory.dmp
memory/5144-6-0x0000000000610000-0x0000000000655000-memory.dmp