1c9baabb5d004de4415de53072594c63bf2aa53948fd3fd3346f27492e81c22d

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 15:23

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_e88c6ec74fa9dbf6754873a734206a0a_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260602-ssf5nagy61
SHA256 1c9baabb5d004de4415de53072594c63bf2aa53948fd3fd3346f27492e81c22d
MD5 e88c6ec74fa9dbf6754873a734206a0a
SHA1 f8feea4093d06e36d55d7ea9775b30c84a19c254
SHA512 b73d4f28c304591d3e357680fdde6ae8c4803baf9d2ba2b638bf2d64ac0e5ec5037a0ce2e0a5d4606cfe32211e4a3a3b3e3fcca2538f4d0646405d9a4986aef3
SSDEEP 12288:3O4rfItL8HPdt38XLScHqgKRQwlIBsTg97rKxUYXhW:3O4rQtGPpcKjtlICK3KxUYXhW
TLSH
T16EB4F12AB681C233D29302751BD6DBD6A63E75720326E4D33BD8027D1EA5AE1D335387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3152	8D66.tmp

Executes dropped EXE 1 IoCs

pid	Process
3152	8D66.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_e88c6ec74fa9dbf6754873a734206a0a_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8D66.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3636 wrote to memory of 3152	3636	2026-06-02_e88c6ec74fa9dbf6754873a734206a0a_elex_mafia_stealc_tofsee.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-02_e88c6ec74fa9dbf6754873a734206a0a_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_e88c6ec74fa9dbf6754873a734206a0a_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3636
- C:\Users\Admin\AppData\Local\Temp\8D66.tmp
  "C:\Users\Admin\AppData\Local\Temp\8D66.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_e88c6ec74fa9dbf6754873a734206a0a_elex_mafia_stealc_tofsee.exe CE551DDDF611F0436C134408FA8622F88AD9FA7DB41D9A29C957204E170A6F427AD52296E11067514DF17CE1D3EF4EFE6055EA71390FE899BB97526D7D5F1AA2
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3152

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8D66.tmp

Path C:\Users\Admin\AppData\Local\Temp\8D66.tmp
Size 486KB
SHA256 81419bd9541d1e9f1c60d95c13ebf47078da17fdc5373fdb4a3f57a459b44ce4
MD5 522ad50cda7d1c7bb669de960e1cc082
SHA1 2857b526f18739c4a3653fe96dd5cf664df97968
SHA512 277152c78c48cb5ea33d2a8afc6b3fa554fcff0e3b2972a65460a07af81f80815fb796670a084d8832de813f5278e797d1fa806613e8cf268f9c2b2a47487b0c
SSDEEP 12288:3O4rfItL8HP6vT/OxPqtxOmbLWqyVwXgumONV7rKxUYXhW:3O4rQtGP6bmPqtxO+jJXR3KxUYXhW
TLSH
T1D9B4F22A76418233D2D3027117DADAD6BA3E79704726A4C33BD4466E1F61BE1D33A387
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download