50ef6dc11cc9a4a3b1031a5da261fc82240ce47101428735e4ad466b178d5690

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
16/05/2026, 02:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-16_4dec8e4b1a2b4060023b082a4dda4fa8_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260516-da66ssav3x
SHA256 50ef6dc11cc9a4a3b1031a5da261fc82240ce47101428735e4ad466b178d5690
MD5 4dec8e4b1a2b4060023b082a4dda4fa8
SHA1 f2178fe1d5819a256ddb56364e62829c553b6443
SHA512 c2b6116180fbc4019c764172f139a7a318281bb7f2ff650e7e40093a5318d56a20ada74c5d26e33af147fc6c8b2f4453c226f737a68f33bdc9dc6b739fc4cd0a
SSDEEP 12288:aO4rfItL8HRvMUpWrSquXJ87eGSdSTLVg647K9wlsDpVFd:aO4rQtGRUUkjucJVg64+9wlsDpVFd
TLSH
T14EA4F129B681C233E29301711BE6D7AB763E79B0036694C377D4026E1FA57E1D37A386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4188	1C2E.tmp

Executes dropped EXE 1 IoCs

pid	Process
4188	1C2E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-16_4dec8e4b1a2b4060023b082a4dda4fa8_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1C2E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1344 wrote to memory of 4188	1344	2026-05-16_4dec8e4b1a2b4060023b082a4dda4fa8_elex_mafia_stealc_tofsee.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-05-16_4dec8e4b1a2b4060023b082a4dda4fa8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-16_4dec8e4b1a2b4060023b082a4dda4fa8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1344
- C:\Users\Admin\AppData\Local\Temp\1C2E.tmp
  "C:\Users\Admin\AppData\Local\Temp\1C2E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-16_4dec8e4b1a2b4060023b082a4dda4fa8_elex_mafia_stealc_tofsee.exe 232712B0CCD67D106DCB84F0A676914766DFC515A9E5FAF94CB13DC06E07108BE01DF09321DB3D609573DDBCB028CAD9BA39F5BE617CE5E6D99F27155B8EEA2A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4188

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1C2E.tmp

Path C:\Users\Admin\AppData\Local\Temp\1C2E.tmp
Size 476KB
SHA256 1c89caa97bf5e217b4f7fa8ee0e63254c8f3458560060abda548153a23792cb7
MD5 1befb48a28384f6aed9f78924413f07b
SHA1 b34606cd74381670915eb3030f67c79a5bdf43ff
SHA512 ba5d64789b22794e47a14b271b2da5ad8d2cecbf1d7d5efdc9db5d2c914ad6b845c6a1b85f54bfdc48b2d078a13034cbc9daea0068b71c7916e6375afa66447d
SSDEEP 12288:aO4rfItL8HRv+esqUt/Y0DdhA0Wm8Vn3gcH7K9wlsDpVFd:aO4rQtGRWnFw0bQHV3PH+9wlsDpVFd
TLSH
T192A4F12976828233D2D301711BE6DBE6A63E78B41736A4C33BD4423E1E616E2D376357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download