7c1d1f7f662a2a6b6f9961fce7b59fd7de18e5402d9afd5891f95989f96f190d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_f8c49001af73cb7914d1c274585c558a_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260602-chb5ysbt2x
SHA256 7c1d1f7f662a2a6b6f9961fce7b59fd7de18e5402d9afd5891f95989f96f190d
MD5 f8c49001af73cb7914d1c274585c558a
SHA1 fa237fb0cfee8277c4fff67e6210bc53d7cec93c
SHA512 dda2ebe419ca51c673ed6c7d40ad422cf92f26e0018bea3101231046d56a15d1a92d8ace82a879624e3d2e7616e24372a87eed32a00163eb695a69fdc47b01f7
SSDEEP 12288:Ci4g+yU+0pAiv+8kM07UseEz9s5bY6PVsIUvn:Ci4gXn0pD+8kMfGMtsX
TLSH
T1CC94F1257582C037E29718355BF5CBA566BE79B10B2278CB7B900BAE2F602D2C734357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2824	53A9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2824	53A9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_f8c49001af73cb7914d1c274585c558a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	53A9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 2824	2124	2026-06-02_f8c49001af73cb7914d1c274585c558a_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_f8c49001af73cb7914d1c274585c558a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_f8c49001af73cb7914d1c274585c558a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\53A9.tmp
  "C:\Users\Admin\AppData\Local\Temp\53A9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_f8c49001af73cb7914d1c274585c558a_elex_mafia_stealc_tofsee.exe 9F15657FFC736C23670C084535950C5746FD471320099171F1882E2FFD3B7ED47DCB3FFBF92380911D70F785F834E0CFA7FE1B2B89DDB494903F192C3F5FC9BD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2824

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

53A9.tmp

Path C:\Users\Admin\AppData\Local\Temp\53A9.tmp
Size 433KB
SHA256 3cd92f0428f9fc78a32ab5b7aea655fde76095e0f9b085145b75621d4733e4be
MD5 b90b1ab308d2d87aadb3a7d565b19a0b
SHA1 3de0b0f11737fc868cc3c57df41906274e12d55c
SHA512 f998b0bd2b198e559ee68ec58ce44527c701d3616b3dd47173744608db5b915e934659d9e7a75112e2a089787222adbf5e44ebe54af00c14ea6403abb0e271f8
SSDEEP 12288:Ci4g+yU+0pAiv+gxiRBrBwv/gE1daOcUfn:Ci4gXn0pD+gxG5KR0m
TLSH
T1BA94E0243592C033D29719344BF5CB6A59BA3AB20B2678CB77901BBD6E643D1D73834B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download