Analysis
- max time kernel
149s - max time network
140s - platform
windows11-21h2_x64 - resource
win11-20260130-en - resource tags
- submitted
11/05/2026, 16:04
General
- Target 2026-05-11_14c53edc559fab8a21d2f781e4185e92_elex_mafia_stealc_tofsee.exe
- Size 447KB
- Sample260511-th885ad13v
- SHA256 a2d77e2f9cc12d95e6758d19071d7f83325598d4227804191ccd21ec97c36548
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
- Enumerates system info in registry 2 TTPs 3 IoCs
- Modifies registry class 1 IoCs
- Suspicious behavior: AddClipboardFormatListener 2 IoCs
- Suspicious behavior: RenamesItself 1 IoCs
- Suspicious use of SetWindowsHookEx 10 IoCs
- Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2026-05-11_14c53edc559fab8a21d2f781e4185e92_elex_mafia_stealc_tofsee.exe"C:\Users\Admin\AppData\Local\Temp\2026-05-11_14c53edc559fab8a21d2f781e4185e92_elex_mafia_stealc_tofsee.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B17.tmp"C:\Users\Admin\AppData\Local\Temp\B17.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-11_14c53edc559fab8a21d2f781e4185e92_elex_mafia_stealc_tofsee.exe 5B0C8CD280A04342955A6A69A3A7015284DE560F23EB3E6F7EF05B0A5DA7F24ADAD71AEF1847445AE62E48D40B79777F250F57EAD82B7358A10BCC65C9E95FE42⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" /n "C:\Users\Admin\AppData\Local\Temp\2026-05-11_14c53edc559fab8a21d2f781e4185e92_elex_mafia_stealc_tofsee.doc" /o ""3⤵
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
-
Network
MITRE ATT&CK Enterprise v16
Replay Monitor
Loading Replay Monitor...
Downloads
2026-05-11_14c53edc559fab8a21d2f781e4185e92_elex_mafia_stealc_tofsee.doc
B17.tmp
gb.xsl
fb3b0dbfee58fac8.customDestinations-ms
memory/1660-32-0x00007FFF6C740000-0x00007FFF6C949000-memory.dmp
memory/1660-35-0x00007FFF6C740000-0x00007FFF6C949000-memory.dmp
memory/1660-18-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-17-0x00000193386C0000-0x00000193386D0000-memory.dmp
memory/1660-23-0x00007FFF6C740000-0x00007FFF6C949000-memory.dmp
memory/1660-24-0x00007FFF6C740000-0x00007FFF6C949000-memory.dmp
memory/1660-22-0x00007FFF6C740000-0x00007FFF6C949000-memory.dmp
memory/1660-21-0x00007FFF6C740000-0x00007FFF6C949000-memory.dmp
memory/1660-20-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-25-0x00007FFF2A350000-0x00007FFF2A360000-memory.dmp
memory/1660-26-0x00007FFF2A350000-0x00007FFF2A360000-memory.dmp
memory/1660-31-0x00007FFF6C7E4000-0x00007FFF6C7E5000-memory.dmp
memory/1660-16-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-33-0x00007FFF6C740000-0x00007FFF6C949000-memory.dmp
memory/1660-34-0x0000019378660000-0x00000193789D8000-memory.dmp
memory/1660-14-0x00007FFF6C7E4000-0x00007FFF6C7E5000-memory.dmp
memory/1660-15-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-13-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-143-0x0000019378660000-0x00000193789D8000-memory.dmp
memory/1660-147-0x0000019378660000-0x00000193789D8000-memory.dmp
memory/1660-156-0x0000019378660000-0x00000193789D8000-memory.dmp
memory/1660-157-0x0000019378660000-0x00000193789D8000-memory.dmp
memory/1660-161-0x0000019378660000-0x00000193789D8000-memory.dmp
memory/1660-163-0x0000019378660000-0x00000193789D8000-memory.dmp
memory/1660-176-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-179-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-178-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-177-0x00007FFF2C7D0000-0x00007FFF2C7E0000-memory.dmp
memory/1660-180-0x0000019378660000-0x00000193789D8000-memory.dmp
memory/1660-181-0x00007FFF6C740000-0x00007FFF6C949000-memory.dmp