93ef152f8acf0f2e08b51f39dec6cca2aca203cc607cc0ab334fb0346b4d28b3

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
18/05/2026, 12:27

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-18_eb1cdf65e42a76e585213175b5132639_elex_mafia_stealc_tofsee.exe
Size 661KB
Sample260518-pm8e6sf14l
SHA256 93ef152f8acf0f2e08b51f39dec6cca2aca203cc607cc0ab334fb0346b4d28b3
MD5 eb1cdf65e42a76e585213175b5132639
SHA1 7726913649188b82f0751104ea49c859fb42af24
SHA512 a6a6b5e9dfc40794e604be9af6d5bf25783ff797a149a6ecb825468de95ab2db79e06bb5cfb796dc0a461f5003346e477448c25041569c8447053840d2fc6788
SSDEEP 12288:lO4rfItL8HPpb2pPTDO7BAViemfczGPy7bPzDr7cT8kyQfYfJDBFC7pU372nIYL5:lO4rQtGPBiXWBAViemf02yfPzDr7cT8I
TLSH
T136E4AF2FB3450373C2C203B2274F99D6B72EA575136A95D265A8812D1363EB8D37B3C5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3420	21FA.tmp

Executes dropped EXE 1 IoCs

pid	Process
3420	21FA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-18_eb1cdf65e42a76e585213175b5132639_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	21FA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2592 wrote to memory of 3420	2592	2026-05-18_eb1cdf65e42a76e585213175b5132639_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-18_eb1cdf65e42a76e585213175b5132639_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-18_eb1cdf65e42a76e585213175b5132639_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2592
- C:\Users\Admin\AppData\Local\Temp\21FA.tmp
  "C:\Users\Admin\AppData\Local\Temp\21FA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-05-18_eb1cdf65e42a76e585213175b5132639_elex_mafia_stealc_tofsee.exe C1104EAFDE6EE3864BF3598CBF4E8A192313C5880F7DBBC4B27C08D69E0AD929539137EA5631D50E04DBCE944AA01B3605A795532028CBBCA523FAB2A0C243B0
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3420

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

21FA.tmp

Path C:\Users\Admin\AppData\Local\Temp\21FA.tmp
Size 661KB
SHA256 ffee3ad0e0d92b2815a50bc86b6ee7e477aea70016e87fde8ea304431939c7ce
MD5 af4a15731b5b8be54f8843d0316cd69a
SHA1 7103c212656d80f51a1d5fce5e9016beb022ff10
SHA512 136214147b29d8d36ae3ce5bef70c5ffeb8cfc1d6d86cbd9aa9675588c1baa219e5f2efa420593a0dbddf1641987171e763b45b9b04d381c8f4a656880c4cf40
SSDEEP 12288:lO4rfItL8HPowVr1hprudjHwxmD3NXW7bPzDr7cT8kyQfYfJDBFC7pU372nIYLBT:lO4rQtGPo8rocIpmfPzDr7cT8kyQfYfS
TLSH
T1BEE4BF2FB3450373C28203B22B4F99D6B73EA575137A95D225AC802D1767EB8937B385
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download