aa49f491ab1b3d33a0d296908dd93db0d5b5f85e25b0d2b22a8a58f887dba98b

Analysis

max time kernel
149s
max time network
93s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_ef4c4b927006cef3450fabe758ce0863_elex_mafia_stealc_tofsee.exe
Size 661KB
Sample260511-dbg83aaw4v
SHA256 aa49f491ab1b3d33a0d296908dd93db0d5b5f85e25b0d2b22a8a58f887dba98b
MD5 ef4c4b927006cef3450fabe758ce0863
SHA1 18ad85827c225b627c9e080f27b07ca68d0b7f41
SHA512 7591056a6c73521db5c0937cb144c85dabef20d0110ca12131da13c2ad28ee4fe7ae83b762647d02ca2df88cb5bf9d4fd0e9c51e8cafcd15d35d0d2b693953f9
SSDEEP 12288:lO4rfItL8HPtpNRUk8YUMyerYSl8Yv2pbgGu7bPzDr7cT8kyQfYfJDBFC7pU372H:lO4rQtGP3M9YU4Y7Y+p6fPzDr7cT8kyM
TLSH
T113E4A02FB7450373C28202B2274B99D6B73EA575137A95D225AC802D1763EB8D37B3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4720	3340.tmp

Executes dropped EXE 1 IoCs

pid	Process
4720	3340.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_ef4c4b927006cef3450fabe758ce0863_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3340.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 4720	2400	2026-05-11_ef4c4b927006cef3450fabe758ce0863_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-11_ef4c4b927006cef3450fabe758ce0863_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_ef4c4b927006cef3450fabe758ce0863_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\3340.tmp
  "C:\Users\Admin\AppData\Local\Temp\3340.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-11_ef4c4b927006cef3450fabe758ce0863_elex_mafia_stealc_tofsee.exe 9C430E3768DC48EDEB162BA86D9648B3098A09BF96369DB08E05063E7D0E0E77E84A7C551315EA1AE4207B7CFDA27212618380DA3896721CA6D7FC08B669EF80
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4720

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3340.tmp

Path C:\Users\Admin\AppData\Local\Temp\3340.tmp
Size 661KB
SHA256 bfffb1622b1bfb5159abce52d7fd09e616e1d76b4ed8267c805980693aa0301c
MD5 d2f67d0689a4a13bdcd7ed8b320b7165
SHA1 cbf2e40593a853e763f9fc6da3390643a31ac9e0
SHA512 2418c09753309b19ce527fd39a3a77353d23b3926776d53be9409295b424a4033ad010f5584c8f4181befebb275227575ebf4f1936e9b8b9d4f5adabc069bdaa
SSDEEP 12288:lO4rfItL8HPWdPdGVqGNC+gCFl5ptqFbf7bPzDr7cT8kyQfYfJDBFC7pU372nIYl:lO4rQtGPWJcqN+F/5sTfPzDr7cT8kyQ5
TLSH
T194E4BF2FB7450373C28203B22B4B99D6B73EA575136A95E22598802D1763FB8D37B3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download