ceddcfc3728ddfe05f84ad5c339a7f50855c9a40fb930833fe34d58237038fce

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 12:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_53e99b4f1b58e54defd286568657aaab_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260602-n9tpvsdx2r
SHA256 ceddcfc3728ddfe05f84ad5c339a7f50855c9a40fb930833fe34d58237038fce
MD5 53e99b4f1b58e54defd286568657aaab
SHA1 4e35c9a83ada3fb15abb594a4d4957ea0385ce90
SHA512 692d510a84f683a0b04dd891e009a211e6d8ce33a10f84e825a6c3272d39b9ce642aa8d6e80af6db367b44ceb81947e52374c303292cffdb414779e91b687e94
SSDEEP 12288:qO4rfItL8HGbJI4hPHKCFjTovs4fx97bWmeEVGL:qO4rQtGGbJdqClTGPfx9umeEVGL
TLSH
T1A6A4F126B641C133D29302751BEADB96BA3E75B40365A0C73BD8037D2EA56E1D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5172	54C2.tmp

Executes dropped EXE 1 IoCs

pid	Process
5172	54C2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_53e99b4f1b58e54defd286568657aaab_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	54C2.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 764 wrote to memory of 5172	764	2026-06-02_53e99b4f1b58e54defd286568657aaab_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-06-02_53e99b4f1b58e54defd286568657aaab_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_53e99b4f1b58e54defd286568657aaab_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:764
- C:\Users\Admin\AppData\Local\Temp\54C2.tmp
  "C:\Users\Admin\AppData\Local\Temp\54C2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_53e99b4f1b58e54defd286568657aaab_elex_mafia_stealc_tofsee.exe E076041C4FEBCD70CE9EBC480EEA10C299151F7A8B8398CD96C48C4B69374E6894634D0D25DC3391CBCF16EBF0CCFBEC6F1E32F2A44B5A8F4FF201C459E085ED
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5172

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

54C2.tmp

Path C:\Users\Admin\AppData\Local\Temp\54C2.tmp
Size 468KB
SHA256 1f6a810f10efa8e21faabbd9c0c8f10ce8d68530b285159e81dc2fa1ecfd21ba
MD5 9bcf583bac7abf34dfd65489cdc9315b
SHA1 be69ee2efd83468fbd198f62db92386f3b79426c
SHA512 7e54484b62f72b5c0ccfe24a66096518ac538600b30dc7ea480cb54045579fffa0be3186dbc935ca9c13f2272dc3cdab65a2ff3f06cbf9bf072a1d25554a0fa0
SSDEEP 12288:qO4rfItL8HG4EgVp9I+RjQvlVGDGWwQ7bWmeEVGL:qO4rQtGGke+RcvODlbumeEVGL
TLSH
T1F4A4F0297281C233C29302754BDBD7AAB63E79B0472594C37BD8027D2EA56E2D376347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download