7d8f0642398c4a63966ae8cd1179306423f4f15a862c16d9ee4159f2fe5f3f4d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260130-en
resource tags

arch:x64arch:x86image:win11-20260130-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
11/05/2026, 10:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-11_4ed395488bd1451d84ada279385d350f_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260511-md4drae14t
SHA256 7d8f0642398c4a63966ae8cd1179306423f4f15a862c16d9ee4159f2fe5f3f4d
MD5 4ed395488bd1451d84ada279385d350f
SHA1 77227a39d82a254449a9f692abe6e0e22d372a44
SHA512 3469d7d07a89e6b08f2b2e394a344c3a16e7255abb23258ebed3b5227aa7a11e615b84f20036f4fcc6b5be1d948e033d6e18acd7a2ede812965dd7a041a9a024
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFThvsqHC73XOnABrcWQl9t5YII+SA0ymqHR:gZLolhNVyEQaqiDeABYbl18LqHR
TLSH
T16194D025B2C1C036D09301314AF6D7B5153E7DA15F62A5DBB7983B6E2E703D0AA3A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3436	11FC.tmp

Executes dropped EXE 1 IoCs

pid	Process
3436	11FC.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-11_4ed395488bd1451d84ada279385d350f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	11FC.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3436	11FC.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5064 wrote to memory of 3436	5064	2026-05-11_4ed395488bd1451d84ada279385d350f_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-11_4ed395488bd1451d84ada279385d350f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-11_4ed395488bd1451d84ada279385d350f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5064
- C:\Users\Admin\AppData\Local\Temp\11FC.tmp
  "C:\Users\Admin\AppData\Local\Temp\11FC.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-11_4ed395488bd1451d84ada279385d350f_elex_mafia_stealc_tofsee.exe 9F353AFB9C3952F6894E26429DFC84C701F12079297C2CFAB2F1D0F760BA74E4332909EDC87DE29979EB36B6FD98D57FACA2219696BBA21F2386A4C105FAE775
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3436

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

11FC.tmp

Path C:\Users\Admin\AppData\Local\Temp\11FC.tmp
Size 428KB
SHA256 9ffa53f7cbbb25a2ee30d12ad50c2ed3468afbcd116c54e6dd6324c7952c49e3
MD5 a62361bf810ab215ff308daf9e0a2653
SHA1 bac5db53bcbc2f1087f04bc7680050eed763b194
SHA512 5d0fa8ada809d3fa18627dce7a363b6e319bcec19cabd5f5fd93dd809f68e3ce6dcba7b1f7c4df971186f61b460e6825fac7e1f702cba4f1c1c0eb02b83d6977
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFytxxq3GNI2WNhPZCvGB41nA8YC8qHR:gZLolhNVyE8WHAPMo41A8MqHR
TLSH
T16594CF2572C1C036D19301314AE6D7B6253A7DA25F6164CBB7D83B7E2E703D1A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads