f29d5f5b34d5f604e3d5fa9807492a64b2a634e6b6b8788ed3acf79dafc3eb66

Analysis

max time kernel
149s
max time network
155s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 14:06

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_00e5e1139f44f1339bb75c905c3a4065_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260602-reet1ae18s
SHA256 f29d5f5b34d5f604e3d5fa9807492a64b2a634e6b6b8788ed3acf79dafc3eb66
MD5 00e5e1139f44f1339bb75c905c3a4065
SHA1 85ef355cac0cf3e5904287ee935fad45f1d57c04
SHA512 ba0abb0721bbe645fca0410f87ab292a26166d156b979f57b586c57e25bc952e675b8df2683ff914f05e428ca79e4b5a9cfc76ba906d273ba872708ea99f9b5a
SSDEEP 12288:3O4rfItL8HPJZqAEPQgdJRpu1oHHzKTWErjqGX7rKxUYXhW:3O4rQtGPJIXogrRpHH+TWqmGX3KxUYX0
TLSH
T1A1B4E12A7781C233D2D302351BD6DBDAA73E79B10725A4C33B98027D1E61AE1D77A346
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5744	C738.tmp

Executes dropped EXE 1 IoCs

pid	Process
5744	C738.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_00e5e1139f44f1339bb75c905c3a4065_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	C738.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 6064 wrote to memory of 5744	6064	2026-06-02_00e5e1139f44f1339bb75c905c3a4065_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-06-02_00e5e1139f44f1339bb75c905c3a4065_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_00e5e1139f44f1339bb75c905c3a4065_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:6064
- C:\Users\Admin\AppData\Local\Temp\C738.tmp
  "C:\Users\Admin\AppData\Local\Temp\C738.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_00e5e1139f44f1339bb75c905c3a4065_elex_mafia_stealc_tofsee.exe 9C1D3F36E0E848D367113ACB9F8C09D388D618DB94205303633E0D55111D92BF6C375A6F8107EB3B8DDEF582A6D4F7B9AB206006F0BD5B25559A4FA5EE1A4EF3
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5744

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C738.tmp

Path C:\Users\Admin\AppData\Local\Temp\C738.tmp
Size 486KB
SHA256 b6e93ed622890d0004b92d414f0503e641988f01604287a3954467f499ed1f1a
MD5 d4a58ab300f35db224ffbfb524aec023
SHA1 48186c47233c3dd2efc70ba8ccdd0be0fbb8e330
SHA512 8d4ce6cdf5325cd787ef8cabab7982f7ecd3b35d12ef8ab4982cc595c3cdb2ca5431c668e36a9e050ffb4c727b26eade5cd4e09bcd067894e6edaba5c7fd65f8
SSDEEP 12288:3O4rfItL8HP6dEi81rTRsXaoL4otYgzsAg7rKxUYXhW:3O4rQtGP6eTX+Nzzw3KxUYXhW
TLSH
T1D5B4F12676818233D28302751BDADBEAA63E75710326A4C33BD4437D1FA16E1D77A387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download