Analysis
- max time kernel
149s - max time network
147s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 12:34
General
- Target 2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.exe
- Size 486KB
- Sample260511-prq2pads7m
- SHA256 d2eede633d8dea002bee1a7ac97d1def3827bdd8f06adb0a9062a71af278996c
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 5 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
- Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
- Uses Volume Shadow Copy WMI provider
The Volume Shadow Copy service is used to manage backups/snapshots.
- Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2AF3.tmp"C:\Users\Admin\AppData\Local\Temp\2AF3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.exe 6ED98D1DA47B194B011D3797E5CF74469282750FCAE53ABC8987604100FE2ACC6E834EC650EC2EF4CA67B8B96B5322B17ACE26B0294F3DAFEEBB998C7B56EF392⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.docx" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-05-11_119163ce7b50cc8a9d243376911635c3_elex_mafia_stealc_tofsee.docx
2AF3.tmp
memory/3080-15-0x00007FFFF3740000-0x00007FFFF3949000-memory.dmp
memory/3080-16-0x00007FFFB37D0000-0x00007FFFB37E0000-memory.dmp
memory/3080-13-0x00007FFFB37D0000-0x00007FFFB37E0000-memory.dmp
memory/3080-11-0x00007FFFB37D0000-0x00007FFFB37E0000-memory.dmp
memory/3080-10-0x00007FFFB37D0000-0x00007FFFB37E0000-memory.dmp
memory/3080-14-0x00007FFFF3740000-0x00007FFFF3949000-memory.dmp
memory/3080-9-0x00007FFFB37D0000-0x00007FFFB37E0000-memory.dmp
memory/3080-12-0x00007FFFF37E4000-0x00007FFFF37E5000-memory.dmp
memory/3080-18-0x00007FFFF3740000-0x00007FFFF3949000-memory.dmp
memory/3080-17-0x00007FFFF3740000-0x00007FFFF3949000-memory.dmp
memory/3080-19-0x00007FFFB0DA0000-0x00007FFFB0DB0000-memory.dmp
memory/3080-21-0x00007FFFB0DA0000-0x00007FFFB0DB0000-memory.dmp
memory/3080-20-0x0000018E75B30000-0x0000018E75B40000-memory.dmp
memory/3080-25-0x00007FFFF3740000-0x00007FFFF3949000-memory.dmp
memory/3080-26-0x0000018EB5A90000-0x0000018EB623E000-memory.dmp