e8143d90728dcd0e4b9c73eeb9d2c20efdc7e63fb5574280ca8dfb59ca9f2e64

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 13:38

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_efef40c2dc17657d7f33bd5955ac6911_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260602-qxtkfaew5z
SHA256 e8143d90728dcd0e4b9c73eeb9d2c20efdc7e63fb5574280ca8dfb59ca9f2e64
MD5 efef40c2dc17657d7f33bd5955ac6911
SHA1 2c2b5b97f1e7688aacc75563b98689cd26dc4a90
SHA512 488d6f48c2952db46480fc5091212d59badbb696de4f8ed6b76939207dd0c52e83fe222afe0e1f68acf8c02f3d1fd72b22d25a460813c9d034ba31dfc5a40074
SSDEEP 12288:qO4rfItL8HGmbNMzDglmb+R7xULenvg7bWmeEVGL:qO4rQtGGCWzDONtF4umeEVGL
TLSH
T1A4A4F1367641C133D29302740BEADAA6B63A79B41726A4C737D8037D1FA16E1D37634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1996	F424.tmp

Executes dropped EXE 1 IoCs

pid	Process
1996	F424.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_efef40c2dc17657d7f33bd5955ac6911_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F424.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2296 wrote to memory of 1996	2296	2026-06-02_efef40c2dc17657d7f33bd5955ac6911_elex_mafia_stealc_tofsee.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-02_efef40c2dc17657d7f33bd5955ac6911_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_efef40c2dc17657d7f33bd5955ac6911_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2296
- C:\Users\Admin\AppData\Local\Temp\F424.tmp
  "C:\Users\Admin\AppData\Local\Temp\F424.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_efef40c2dc17657d7f33bd5955ac6911_elex_mafia_stealc_tofsee.exe 28BA4EF96F8876B275D432C346BAFFBA2CAD018A1E1B3349ED1A3F6B8445E5B27A6D7017858034BE450F2AE90062E421972FAE935FD8C28F07B1F6081301F3C7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F424.tmp

Path C:\Users\Admin\AppData\Local\Temp\F424.tmp
Size 468KB
SHA256 7cedb771d3521da1737b00cb7ce207cda403392f079d99decfac0a266b8b1b59
MD5 25b60ad89457ffbbfb00af226ec8b320
SHA1 0118872e1e78413db577ccedfb1806718522e4c5
SHA512 c886c62adbe6ccebafe882869de4d4c501d5e6ff299aebc66c27a0430fa016c327b88982266ef89b2b58935a716e22c0fa369582dc1633811f5a6e26e0af6a84
SSDEEP 12288:qO4rfItL8HGKnFo/pOUkoH821YW0/7bWmeEVGL:qO4rQtGGKnFo/pOpA8Y2umeEVGL
TLSH
T1D2A4F13AB6828133E29312755FD6D7AAAB3E75711326A4C73BD8027D1F606E0D336346
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download