9bde97b7ce6d778ed32f74290949a01d69c0c7f09731bd13f4f4f278deb51f4d

Analysis

max time kernel
149s
max time network
96s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 13:28

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_dcfa58db44c2574626d8c3c8e732267b_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260602-qqqj7set81
SHA256 9bde97b7ce6d778ed32f74290949a01d69c0c7f09731bd13f4f4f278deb51f4d
MD5 dcfa58db44c2574626d8c3c8e732267b
SHA1 4fbb5f53c9286acad77aa1522c8d94ee38bd88eb
SHA512 0af5c4d00e9af909f9b455f83431dce445f848296daadd427c01403500a96e43f2896feb8519ee5d05a308f2461b631518e19cd4d71a1e50c5d9a07ec03c78d7
SSDEEP 12288:aO4rfItL8HR7vqXBrLsmx8vWnLNpHgicJnpTMsQYs7K9wlsDpVFd:aO4rQtGR7u1Lsm6enLNdKZQYs+9wlsDn
TLSH
T11EA4F13976868233D29302701FD6D7A6BA3E75B14336A8C33B94027E1F656E1D37A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4124	C1E8.tmp

Executes dropped EXE 1 IoCs

pid	Process
4124	C1E8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C1E8.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_dcfa58db44c2574626d8c3c8e732267b_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2128 wrote to memory of 4124	2128	2026-06-02_dcfa58db44c2574626d8c3c8e732267b_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_dcfa58db44c2574626d8c3c8e732267b_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_dcfa58db44c2574626d8c3c8e732267b_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2128
- C:\Users\Admin\AppData\Local\Temp\C1E8.tmp
  "C:\Users\Admin\AppData\Local\Temp\C1E8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_dcfa58db44c2574626d8c3c8e732267b_elex_mafia_stealc_tofsee.exe DC3DDC46E6751229A27EF8C7566261EDD3860EBC18931AEEE8BE3DD75EC181C26D52B9103C1BA9B29229C57AABA6F9E643A7411AB4E87E13846C64EF46751BE1
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4124

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C1E8.tmp

Path C:\Users\Admin\AppData\Local\Temp\C1E8.tmp
Size 476KB
SHA256 401e571fedd947661b0e690a4b50f4dc469e8c65cf1bfb338ab0d597ec3f3e52
MD5 a175166fb89eb5806213fd21ddecac44
SHA1 c63204d124aed5ae5100c83d98675493ef857cc2
SHA512 1998fecf20469b3527d8ecac7db79ef4013b2effd5df671d6c6ccdd6f0ac991e98332ef77e111d74eea1ee899d629acc65bef84ca511890bcc94682bea0d48f6
SSDEEP 12288:aO4rfItL8HR8RESt0+bT/hYV6t7K9wlsDpVFd:aO4rQtGR8RESOSZYUt+9wlsDpVFd
TLSH
T1C8A4E12A7682C233D69202314BD6DB96A73E75F0172AA4C73BD4027D2F61AD1D73A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download