f8771a94bb0b0c9cb6466ffeee9288daf7e4d07b609919510e73749c656e385e

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 11:59

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_5ad1e12386f9c5846747536780ff12dc_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260518-n58yzsft3p
SHA256 f8771a94bb0b0c9cb6466ffeee9288daf7e4d07b609919510e73749c656e385e
MD5 5ad1e12386f9c5846747536780ff12dc
SHA1 526242d02b3e06b0468cb82d933c1f384bd8f652
SHA512 dff3db67fd13cefa88157e5ed5264451557d5f57cec1498b78876b9aada66527809b492eeb72c9032c8f2d9146aab067f198410a6316c913ecdaf28a3e2ed443
SSDEEP 12288:Nb4bZudi79L2EUVCJynlGIu8/LGrY4BCpA0a:Nb4bcdkL2JCklGz8QAw
TLSH
T1C1A4E0243681C033E2A712344AE5CBB5A67E7DA15F2664C73BD43B6E6EB02E1D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
796	FED2.tmp

Executes dropped EXE 1 IoCs

pid	Process
796	FED2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_5ad1e12386f9c5846747536780ff12dc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FED2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3996 wrote to memory of 796	3996	2026-05-18_5ad1e12386f9c5846747536780ff12dc_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-18_5ad1e12386f9c5846747536780ff12dc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_5ad1e12386f9c5846747536780ff12dc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3996
- C:\Users\Admin\AppData\Local\Temp\FED2.tmp
  "C:\Users\Admin\AppData\Local\Temp\FED2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-18_5ad1e12386f9c5846747536780ff12dc_elex_mafia_stealc_tofsee.exe 68110DE8D6CCAD9BD23281FC4AC8FD9BA727BC6BF2231B2F537D11BB14163ECA29714E7880FB21D4C1191B52CC14A7DF721F9B507AEA04B1F467D11F5159B6EA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:796

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FED2.tmp

Path C:\Users\Admin\AppData\Local\Temp\FED2.tmp
Size 473KB
SHA256 7f294b49d6b2b478bd38851feb1b5f743e7af3f4ad273a4502937a3ad0cf6d3b
MD5 7ada4479af7327073726909e990abc6c
SHA1 d541fac30869b4c9e9e2339d43c9b0c19e93cd11
SHA512 1bc57321ac724c6071afb9b4e5d111da9447c7f8f84f4d977a2cf260677a37778f4cc5e43e8650ac6d003481fee8e84dd3afc393bab232d6fec4f0e701cc6091
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iSt/KJEplR1LLrg77CA8yTROb98a9or42SA0a:Nb4bZudi79LQKJ6HL3gHXBTROWae2A0a
TLSH
T1A0A4E0283581C037D1A316384AF6C7B6567A7DA15F2168CB3BD03B6E6EB06E1DA34317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download