04a5f7f190214b992f2ab0ea4aa74552a4ae566a23e343b54095feab4bec2def

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_d3d5c31e9b7e5a21b2f4fd8c73cb5ec3_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260602-trd5caas3s
SHA256 04a5f7f190214b992f2ab0ea4aa74552a4ae566a23e343b54095feab4bec2def
MD5 d3d5c31e9b7e5a21b2f4fd8c73cb5ec3
SHA1 ff69330509b52f45cdcf72a0ad29e2dfe772a2fd
SHA512 7daf73afae6cad4ef71085e4f631ec4938d91f631b35d61d122d00db0a4aa76c20bcee7143457959eb770567320d67b630e526c294652faf30195436f1ea8b58
SSDEEP 12288:Z594+AcL4tBekiuKzErI6fyj4GhaMLVgQ+NpnwD6kLWvl:BL4tBekiuVrHfy8GhRVgQKJkL2
TLSH
T11894F1353582C037E29705344BE5CB66567A7AB20B26A8C77BD04BBE5FA02E2D770347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3636	52FD.tmp

Executes dropped EXE 1 IoCs

pid	Process
3636	52FD.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	52FD.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_d3d5c31e9b7e5a21b2f4fd8c73cb5ec3_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3436 wrote to memory of 3636	3436	2026-06-02_d3d5c31e9b7e5a21b2f4fd8c73cb5ec3_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-02_d3d5c31e9b7e5a21b2f4fd8c73cb5ec3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_d3d5c31e9b7e5a21b2f4fd8c73cb5ec3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3436
- C:\Users\Admin\AppData\Local\Temp\52FD.tmp
  "C:\Users\Admin\AppData\Local\Temp\52FD.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_d3d5c31e9b7e5a21b2f4fd8c73cb5ec3_elex_mafia_stealc_tofsee.exe CE761829C35058ABD182945B094216F5FDBC37B3C1FB3D05EA30AC039A3B24E491012F742F4962B98681E47E1059D23B03E949B7F644D9BDB32095F965F1856E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3636

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

52FD.tmp

Path C:\Users\Admin\AppData\Local\Temp\52FD.tmp
Size 428KB
SHA256 17d988ebeb29a7363ae58ac8233dd63b287add70ba3bc1be93e3f2da819855a3
MD5 1af5042ff0ac2a464fdb6ddd5347e996
SHA1 f71fc34a0aa7e479fd5fd1911e97074daac9c4fb
SHA512 c234fd837e4165e293563e644ce280ad66e2a30fca90e23d0b94f68c735b8c1d8e938898526389f0d7bf27982b6a2c31ca66406cf3697c4823961527e1098a29
SSDEEP 12288:Z594+AcL4tBekiuKzErY0eTp12iy7cJ5QSZWVsfMEWZVl:BL4tBekiuVrYyiyJEwJV
TLSH
T15094F1313282C037E29715394BE5C7AA667E7AB64B25A4C73BC017BE5E602D2E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download