da053834ba7eba6fd0b877f1c28b0e62040d1ff75b5a55628061b1f6c8d976ab

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 12:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_a66d4b193f80a8a62018b9e56d28d022_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260602-pqvcqaev7n
SHA256 da053834ba7eba6fd0b877f1c28b0e62040d1ff75b5a55628061b1f6c8d976ab
MD5 a66d4b193f80a8a62018b9e56d28d022
SHA1 b5631ab17ab14d285f715ffe8da147c8157ce3cf
SHA512 4f1b8b57cbe60b34be0999cbd8755c89f83c76bd1664b795550fa20878fd0e773712128d561aca3019c6b5d3032863306b5b4df3603cb676a279aa2eb6e4e335
SSDEEP 12288:U6PCrIc9kph5ty/dViUeH8UpMxznSzurzF:U6QIcOh5sVid8RxL2urz
TLSH
T18694D02036C1C036E2A705319AEADB66293E7E755B32A8C777D467AD6E706C0E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1732	3738.tmp

Executes dropped EXE 1 IoCs

pid	Process
1732	3738.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_a66d4b193f80a8a62018b9e56d28d022_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3738.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1732	3738.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1096 wrote to memory of 1732	1096	2026-06-02_a66d4b193f80a8a62018b9e56d28d022_elex_mafia_stealc_tofsee.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-02_a66d4b193f80a8a62018b9e56d28d022_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_a66d4b193f80a8a62018b9e56d28d022_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1096
- C:\Users\Admin\AppData\Local\Temp\3738.tmp
  "C:\Users\Admin\AppData\Local\Temp\3738.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-02_a66d4b193f80a8a62018b9e56d28d022_elex_mafia_stealc_tofsee.exe E5A5ADD8FFC60F97E50FF71420157F9A5CC872080CA34B4EC42BC7AA97304800E3BD2B94C2065C2E5D25636CF6E9A65D5D6DAA1EAD9C2C6DDCB7AC79B435AD9E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1732

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3738.tmp

Path C:\Users\Admin\AppData\Local\Temp\3738.tmp
Size 412KB
SHA256 dd42ebc8abd3497c9d0d03ab0f2df1810b154e35be5717056d42565fec2574ea
MD5 fc1f2aac10d0fc761f4e45acf79f990a
SHA1 9f63f3c994205082466f9a4344969999118bf7b4
SHA512 3f1a27deaacc893f1540d1e8f0413e13a4efd9becae435895fc19c034546d968c5e06ebcf68bc2b03452439877236f77acd91c224e6463bb5353d87bfa1bf9ff
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnAhp7taPx6qeCK4r/s15NOGcuBhaJ9P:U6PCrIc9kph5ibpirKFdB4J1
TLSH
T1B994D0347181C076E1E306314AE6DB66697E3D714B22A8D76BD42BAE2E713C1E739307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads