Analysis
- max time kernel
149s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20260130-en - resource tags
- submitted
11/05/2026, 12:34
General
- Target 2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.exe
- Size 486KB
- Sample260511-prq2pads7m
- SHA256 d2eede633d8dea002bee1a7ac97d1def3827bdd8f06adb0a9062a71af278996c
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1E8F.tmp"C:\Users\Admin\AppData\Local\Temp\1E8F.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.exe E27AC4774B9865B52B307CA3DC7C2F66D00FB1AD84348F2E3D0B78969C59715DF80FCC8248AAA0F2B1E2EDCAAC492FCA90241CD3766ED6496A16827A5C2E50FF2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
1E8F.tmp
2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.docx
memory/4168-20-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp
memory/4168-18-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp
memory/4168-16-0x00007FFAEA750000-0x00007FFAEA760000-memory.dmp
memory/4168-19-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp
memory/4168-22-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp
memory/4168-24-0x00007FFAE85E0000-0x00007FFAE85F0000-memory.dmp
memory/4168-23-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp
memory/4168-21-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp
memory/4168-37-0x000001D9A11B0000-0x000001D9A18EF000-memory.dmp
memory/4168-11-0x00007FFAEA750000-0x00007FFAEA760000-memory.dmp
memory/4168-26-0x00007FFAE85E0000-0x00007FFAE85F0000-memory.dmp
memory/4168-25-0x000001D961210000-0x000001D961220000-memory.dmp
memory/4168-17-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp
memory/4168-15-0x00007FFAEA750000-0x00007FFAEA760000-memory.dmp
memory/4168-14-0x00007FFB2A76D000-0x00007FFB2A76E000-memory.dmp
memory/4168-13-0x00007FFAEA750000-0x00007FFAEA760000-memory.dmp
memory/4168-12-0x00007FFAEA750000-0x00007FFAEA760000-memory.dmp
memory/4168-36-0x00007FFB2A6D0000-0x00007FFB2A8C5000-memory.dmp
memory/4460-4-0x0000000001220000-0x0000000001239000-memory.dmp
memory/4580-10-0x0000000003D60000-0x0000000003DBE000-memory.dmp