7ac581a8c85f1a9458ce47e60154f5b71a76520d70b131d08498dfdb464bf2e0

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260522-rcdtxsc19r
SHA256 7ac581a8c85f1a9458ce47e60154f5b71a76520d70b131d08498dfdb464bf2e0
MD5 eaf3ec5031d9a955c204ca08634f8628
SHA1 b7ecf885bef380fa81944a8505f65f4deac35689
SHA512 d701a983b522dc031808370858cce4dca08c305e33639eaff29b48d0d7a0ca48e1d3cdf1f1fa587309025299735bea43c1b3c85a0c92ce3979bd93134bcc25ed
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHC8PYWS7PDpdFw4L/ToIB1AEB1fdlOP+Z:Zm48gODxbzI8PYWS7LBw6oquuOP+Z
TLSH
T1BD84CF3875818037E19601324AFAE7611A3B3DB6876168C77BE47B6D9FB03D1A63434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1240	1846.tmp

Executes dropped EXE 1 IoCs

pid	Process
1240	1846.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1846.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1240	1846.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6124 wrote to memory of 1240	6124	2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6124
- C:\Users\Admin\AppData\Local\Temp\1846.tmp
  "C:\Users\Admin\AppData\Local\Temp\1846.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-22_eaf3ec5031d9a955c204ca08634f8628_elex_mafia_stealc_tofsee.exe 7B015DE1081A5BE3FBAED3212A8535A437981F398C210A1E72D3B79BB0E0208A28188E2C01CF577A5739D2843778E0E96156379BAA0656554826E06041CF5600
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1240

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1846.tmp

Path C:\Users\Admin\AppData\Local\Temp\1846.tmp
Size 384KB
SHA256 50e1ae275505c3332e925ddeffbd7c65f4db488290a5dff1d9b654a1ce2015f5
MD5 531d666b78245df6d8220df9a3202864
SHA1 eae30611f8281b40739227c0ac516d2aeb94621a
SHA512 9208c6a3e6f6b4ffba8865bc1928ed0f1f959dd97e033c084f8f2dd21da8a38689284d3a3ddf3f03a571847438d1e017b863f681a75116e5c5f0958a301542c9
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hH8vcXGmFhRahOieWIG1tlFAvD/PIuJkoZ:Zm48gODxbzjXG62eZWwZJkoZ
TLSH
T15C84DF24B580C036D19A01315AF6E762693B7DB28B2168C77BE47B6D9FB03D1A73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads