85a29635f09786fc93053096a8026faeaf7aa2ed2a6dc3041f0c232adbcf4475

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
22/05/2026, 15:41

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-05-22_f262029785005333134f4ba89d29b6e9_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260522-s441vsav8w
SHA256 85a29635f09786fc93053096a8026faeaf7aa2ed2a6dc3041f0c232adbcf4475
MD5 f262029785005333134f4ba89d29b6e9
SHA1 a8a90ab7708b6dd9548ec08980b18846366740ba
SHA512 39632a9ed75925983bef16a9fcc01a215db059eef5127757066b3db319bb2ac4b452472c45f73b86d0a95214804477809a1a147f7f519f37b596630bfd9165fc
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFT8M19QZKSE4SCAOT3lTB9TxoNB7tNhVbqHI:gZLolhNVyES19QZ7AOT3oBvfbqHI
TLSH
T17394CF24B6C1C032E19305318AF6E776593A7DB15B6164C7B3983B3D1FB42D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1812	8D18.tmp

Executes dropped EXE 1 IoCs

pid	Process
1812	8D18.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-05-22_f262029785005333134f4ba89d29b6e9_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8D18.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1812	8D18.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3924 wrote to memory of 1812	3924	2026-05-22_f262029785005333134f4ba89d29b6e9_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-05-22_f262029785005333134f4ba89d29b6e9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-05-22_f262029785005333134f4ba89d29b6e9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3924
- C:\Users\Admin\AppData\Local\Temp\8D18.tmp
  "C:\Users\Admin\AppData\Local\Temp\8D18.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-05-22_f262029785005333134f4ba89d29b6e9_elex_mafia_stealc_tofsee.exe 6213115197EEAD0903523F7EB8846FACB02A6B840F03943D74FAFAE71AADC24E56859477F5A4DCBE19330E30C339F470C7E5F179E857E58E368E1DC60F4F5C75
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1812

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8D18.tmp

Path C:\Users\Admin\AppData\Local\Temp\8D18.tmp
Size 411KB
SHA256 71c01033ab195481c0e87eeda0aa98fc5a0d7822f8815b17d5fb52fdb3d6f761
MD5 8d1500b63a68d78769773abc7330e262
SHA1 53f0c7b7a98434626e7b087273f7702375baa9aa
SHA512 59ee66d6e8114828d43bb15f7bbb2b7e942008e907646a18b138ce71eb4b6edc834b639677315ad51b5d3420adfd3f13482077d7b2a8fe51dad9e1a60cfb61ee
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mF1/+TkBMpuH2tvTZZRKZLbs+i/3HayQHxe5mqHI:gZLolhNVyEQ/+TQMUyLlKZL4+QK3ZqHI
TLSH
T16D94D028B281C032D19605314AF6EB76293E7DB15B61A4C7B3D8377D1EB03D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads