4f4ffb22f0b037b49f2f4e0764e57a67d5bd06285f46a4f5c094a6d5bf7915f0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 04:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260511-exs35abs4z
SHA256 4f4ffb22f0b037b49f2f4e0764e57a67d5bd06285f46a4f5c094a6d5bf7915f0
MD5 9c5eafc66530aaf59bf4b70ea936301f
SHA1 df7ff17bcff811ea1fb257d3f488ee60a3fc4df9
SHA512 cc64021a36f73c0477aa3e219a2ca7c1cc84b3c9e3bb871d95e93b1d02d41b31169e82e3399e84d699d702e73a23fac49a831294f85f09010d678a9246a3d379
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStO7bE+rUtTQQX6UCKw2lV8UvvszbVNo8CGc6:Nb4bZudi79LITp6p2lV8U3Apc0kPvBA
TLSH
T111A4F1207581C037E29716384FE5D7B5657E39A24B26A8C73BE05BAE1EB02E1E734317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1444	F879.tmp

Executes dropped EXE 1 IoCs

pid	Process
1444	F879.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F879.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4808 wrote to memory of 1444	4808	2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe	78

C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4808
- C:\Users\Admin\AppData\Local\Temp\F879.tmp
  "C:\Users\Admin\AppData\Local\Temp\F879.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-11_9c5eafc66530aaf59bf4b70ea936301f_elex_mafia_stealc_tofsee.exe 6AE299FAC8CBF4575B8840B74C73ED3BE6B01FFB03D8D648D90432D2B64552070C734B72694915D91604BCB5DC0F69CE5BF5021314C6E88AC58C118168F60636
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1444

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F879.tmp

Path C:\Users\Admin\AppData\Local\Temp\F879.tmp
Size 444KB
SHA256 cbbdd71c775f37042bbd1146b824648e7fe6db6cde919b29cc600cce68942912
MD5 91a9085a91837ffbc0100c1ac4d49e16
SHA1 c3816e14ed97de27b344300aa25be655b81812aa
SHA512 edd8d5dd95dfa3fecee8cf808b3486847a086d67091573a683cad0ab5d780ffe398b754a1ab250c2c60649041f9a792f00d6379b66327290fb13fc74be66e95f
SSDEEP 12288:Nb4bZudi79LYB+8sFQk0tyUTd/2yIgbe3J/Qu5fgA:Nb4bcdkLYBbsGkYy+85vf
TLSH
T1E9A4E1243582C037E29306394BF6CB7566797DA14B2668C73BD46BAD6EB03E1D63130B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1444-5-0x0000000000930000-0x0000000000A0F000-memory.dmp

Download

memory/4808-4-0x0000000000AD0000-0x0000000000BAF000-memory.dmp