814df8a0a02c026f0c48112b2fc3910799af6829af085be49a428741be7c827c

Analysis

max time kernel
149s
max time network
104s
platform
windows11-21h2_x64
resource
win11-20250502-en
resource tags

arch:x64arch:x86image:win11-20250502-enlocale:en-usos:windows11-21h2-x64system
submitted
11/05/2026, 01:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260511-br2arscw5p
SHA256 814df8a0a02c026f0c48112b2fc3910799af6829af085be49a428741be7c827c
MD5 6b38fd50f918726e1002809e4deee390
SHA1 d7cced9375db8373931a7189c9b48c6faf800a2b
SHA512 f5fecbe8549a37211c37c10a4454765ae530549c6eb3f84342e053b5e2fde3304d37f2e041f8f38ccf4fa1664ca7d14258b0e4106a87f856f1dc7432a5c91280
SSDEEP 12288:Wq4w/ekieZgU6GrtS+MmG5kgaZME/+wdl:Wq4w/ekieH6ctS+MmPgaSCF
TLSH
T12B94E0213596C037E6A705348BE5CB6A592D7DB50B32A8C737D02BAE5E742D1EB3430B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2192	702F.tmp

Executes dropped EXE 1 IoCs

pid	Process
2192	702F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	702F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2192	3016	2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\702F.tmp
  "C:\Users\Admin\AppData\Local\Temp\702F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-11_6b38fd50f918726e1002809e4deee390_elex_mafia_stealc_tofsee.exe 211769F22F58A872AEDE6ECFD8D15D182BD116E255B139E2E0B9DA9FB5460A5FB33A5D311243635B3545A77EE2E9EC9EA4FB2EFC158FD25E890BEBB35D1A8D3A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

702F.tmp

Path C:\Users\Admin\AppData\Local\Temp\702F.tmp
Size 414KB
SHA256 080aed92f3a142eadb531ffbe44acc0570837b76817c1680a0ca41f48256fea7
MD5 91c89ecca564d3fb01218543240fe4cd
SHA1 78abec852982fb34ef6140400bc9c7b07073dc49
SHA512 618298550f3fe37435323ce096356fb9eb287670421dd21a9fa97295e0b534c511c87d8913c6efabbf795ecd251ab3b4e377da009e14f54182cad3a43a31b142
SSDEEP 12288:Wq4w/ekieZgU6U416Eahz3EMfAfQyvmRGql:Wq4w/ekieH6USZkt
TLSH
T1ED94E0213592C037E1A316344BE5DB6A597A7DB04B32A8CB3BD02BAE6E742D1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download