127793b50f9d1fb2a37b3783357871a3a365d0b860b65d8965e16f267682a8cc

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
01/06/2026, 12:19

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-01_2a1397282da7d64ee7121004f9452f75_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260601-phj7sadv8m
SHA256 127793b50f9d1fb2a37b3783357871a3a365d0b860b65d8965e16f267682a8cc
MD5 2a1397282da7d64ee7121004f9452f75
SHA1 e01bdc7373f48a978a11837122a0f8f6ef5e8e7b
SHA512 9d65b0daf7ef995336a227b4813c6ce7ee857f4ad72b08dab65ece3d73055708673389f4f8b55c2181d27a348e89eddecd27ccb16917b2f9d8c3cbb3ea399a68
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hH9c1UKYiUfksCyy29oifR+TZ:Zm48gODxbzMOksCyroPZ
TLSH
T1EC84DF2472C1C033D19702314BE6E7661A3A3DB29B6568D77BE47B6D9EB03D1A73420B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4256	C227.tmp

Executes dropped EXE 1 IoCs

pid	Process
4256	C227.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-01_2a1397282da7d64ee7121004f9452f75_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C227.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4256	C227.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3976 wrote to memory of 4256	3976	2026-06-01_2a1397282da7d64ee7121004f9452f75_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-01_2a1397282da7d64ee7121004f9452f75_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-01_2a1397282da7d64ee7121004f9452f75_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3976
- C:\Users\Admin\AppData\Local\Temp\C227.tmp
  "C:\Users\Admin\AppData\Local\Temp\C227.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-01_2a1397282da7d64ee7121004f9452f75_elex_mafia_stealc_tofsee.exe C635798C5AD3CD89608C792D18FA0EDBB4B4FF5139657765716CE47828BEBBA73201FB099B98AC8C0A0DEAE4D8A8986DD5605E5274E5DA61AB3A3E96138A6020
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:4256

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C227.tmp

Path C:\Users\Admin\AppData\Local\Temp\C227.tmp
Size 384KB
SHA256 9d90e0b1d632c4170d5add2711eafb08c9b9452d73cb2bc734de7fc8a4fb13a4
MD5 3ec12b711da19a7b6c40c0519fd0cc93
SHA1 8d1847c06ea3a098ddb1f5bbbfd6f0a7d6232946
SHA512 6f0d3b37f956fa6234e081ba4bf75c6fe63802f14eb1f3d9f8bc3ce24e04d42e37c67dc7b3cdcd2996aca6a03f5e9e9c66e0ab04af5ae7c735e03230164b837f
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHPxYxuiU2Oke58Cb5go1dDxT5j818KCZ:Zm48gODxbzpSvemZK1TB818TZ
TLSH
T11084DF347181C037D19601314BFAEB61293A3DB68B6468C73BE47A6D9EB43D1A73834B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads