3138c5462135257b58054b82b354c42e4397cf4a035bba38be4b08b91084a60d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 02:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_bfa4f03b075c823a36d8b08192d76026_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260602-cmfc6scy7m
SHA256 3138c5462135257b58054b82b354c42e4397cf4a035bba38be4b08b91084a60d
MD5 bfa4f03b075c823a36d8b08192d76026
SHA1 6b1f506b6c1224e44deecc9eb44822dd02221f5d
SHA512 4cb12e4c3bca596abf9a9c868c8d894105271dcdc139890521670390ee8a4bae53548aa066c387ebdb36e05c1c7432fee9cc5f664b99c1d53dba8b7a23435a3b
SSDEEP 12288:Nb4bZudi79LrlLW3uRUtEOPrD+QbpYOv5Cf3oZyA0a:Nb4bcdkLrBMu0pDDWOv5O0
TLSH
T191A4E0283291C037E1A716344BE5C7B5663A7DA15F6568CB3BD43B6E2EB02E1DA34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3296	2A86.tmp

Executes dropped EXE 1 IoCs

pid	Process
3296	2A86.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_bfa4f03b075c823a36d8b08192d76026_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2A86.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4964 wrote to memory of 3296	4964	2026-06-02_bfa4f03b075c823a36d8b08192d76026_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_bfa4f03b075c823a36d8b08192d76026_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_bfa4f03b075c823a36d8b08192d76026_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4964
- C:\Users\Admin\AppData\Local\Temp\2A86.tmp
  "C:\Users\Admin\AppData\Local\Temp\2A86.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_bfa4f03b075c823a36d8b08192d76026_elex_mafia_stealc_tofsee.exe 5921DDA3621149D5388D94DFEF1C711849B06D4A16119AE78FE5DB9C5C38987E032124403579D1D3979F7331A59534B56AA43653E1AD614339326D3F9F0E40C9
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3296

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2A86.tmp

Path C:\Users\Admin\AppData\Local\Temp\2A86.tmp
Size 473KB
SHA256 a61d7a897f43f5e9e1394b45afa175eb2dab921714203a715428800bf6224450
MD5 15c3efa2a7a49af35676f3d5544c78b8
SHA1 d134b48dd0aa91b1e006930677eb168d4e4fe0c3
SHA512 66bd8544275e01ac70f5bb5cfef8d27c9232bcf16b444093faf5207733198dff3157cc93a7090db507a246c533993a296369fd3f0fd305d8516d26c793a6569f
SSDEEP 12288:Nb4bZudi79LXVDrqsuTQ+/XuxbsuWiHQ8mLIA0a:Nb4bcdkLlnqsarisJiwnH
TLSH
T116A4E0203582C037E16706384BEAC7B5653A7DA14F2264CB3BD43B6D6EB06E1EA35357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download