9d488145d9acac4ce2254aa8c32212e36f2bcf6b1860df1be4d3a04f71946a1d

Analysis

max time kernel
149s
max time network
116s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 17:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_6c526598af2df39b62facf5d37eef0b9_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260602-vxg9macx5m
SHA256 9d488145d9acac4ce2254aa8c32212e36f2bcf6b1860df1be4d3a04f71946a1d
MD5 6c526598af2df39b62facf5d37eef0b9
SHA1 7f261644c1bada1bba63142d2a7ee950faae171c
SHA512 a8354833709e92a1cea4758fa020c558dc21ad56319963e5e2aeedd26d0d97c5307d63f9144ddf995e9d777e394e608d283d8a419c7f8acafa61ae7d5a755b80
SSDEEP 12288:Z594+AcL4tBekiuKzErYFhBcgI99KeBwCt/0ZJl:BL4tBekiuVrkvI9nsv
TLSH
T13194F1353582C033D1A716384FE5DB6A197E76B24B26A4C737D01B7D2EA82D2D73834A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4272	B55.tmp

Executes dropped EXE 1 IoCs

pid	Process
4272	B55.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	B55.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_6c526598af2df39b62facf5d37eef0b9_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4812 wrote to memory of 4272	4812	2026-06-02_6c526598af2df39b62facf5d37eef0b9_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_6c526598af2df39b62facf5d37eef0b9_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_6c526598af2df39b62facf5d37eef0b9_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4812
- C:\Users\Admin\AppData\Local\Temp\B55.tmp
  "C:\Users\Admin\AppData\Local\Temp\B55.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_6c526598af2df39b62facf5d37eef0b9_elex_mafia_stealc_tofsee.exe 85FD551E90E9007897D89225AC2471636EBBE8C9D6037107464C20A434DE0460DB3348CFE23FB06FB055B708BA10F0BFFDEE391D5C5AA5EEE3CCAEF203C6BE0A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4272

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

B55.tmp

Path C:\Users\Admin\AppData\Local\Temp\B55.tmp
Size 428KB
SHA256 b27c97bdd4cbd908fea4c11b85975f65fe8c0b5807b86a63cd1fb693426ce0a6
MD5 9b964175a7a4d0efedde0f5d7350446f
SHA1 52dbfc9122e90df97092c52f9bc1bc880bbbc165
SHA512 9ce599d482863417362692ced0ff59a89ed9ecbe7ffca30b063451cb86235cf7274d004b63d8d93e28a7422e6ea703e4356aadce0908fb32c3b9480c111fe303
SSDEEP 12288:Z594+AcL4tBekiuKzErjB9Sa+H3M4veezkte56G+uFKBpvV6Ll:BL4tBekiuVrHSH3M4vpwte56GRFKsL
TLSH
T13E94F0313582C033D2A716344FF4CB6925BE79A59B2AA4CB7B80176E5F542E2D73438B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download