dd37f8b1bc797c1708eb1e231ec1a31a81b82efb0d55f73afc3d124a585dd0ba

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
02/06/2026, 17:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-02_b0cde7ba95d9bc3bfe2317799aff390d_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260602-wjpbfsc17p
SHA256 dd37f8b1bc797c1708eb1e231ec1a31a81b82efb0d55f73afc3d124a585dd0ba
MD5 b0cde7ba95d9bc3bfe2317799aff390d
SHA1 a6af0523a78a4bf46d02a097ed35242c2163d3b4
SHA512 ecf434e429d05faf676c11b1b5441a755f74d6549a64086ee5051d15a014d56be901a8f0defb7fc818d41e0fbdc539d6856bfdcba3d1b5e54b54a855b65452af
SSDEEP 12288:qO4rfItL8HGk7zHRxW55I1feWcsboVk+dliZk2Vv6xoRq7bWmeEVGL:qO4rQtGG2b65qdepBq+bKFiowumeEVGL
TLSH
T1F7A4F1267284C133D29312751BE7EBAAA63E74754726A4C337E4427E1EA17E0D33634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4868	887.tmp

Executes dropped EXE 1 IoCs

pid	Process
4868	887.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-02_b0cde7ba95d9bc3bfe2317799aff390d_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	887.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3856 wrote to memory of 4868	3856	2026-06-02_b0cde7ba95d9bc3bfe2317799aff390d_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-02_b0cde7ba95d9bc3bfe2317799aff390d_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-02_b0cde7ba95d9bc3bfe2317799aff390d_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3856
- C:\Users\Admin\AppData\Local\Temp\887.tmp
  "C:\Users\Admin\AppData\Local\Temp\887.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-02_b0cde7ba95d9bc3bfe2317799aff390d_elex_mafia_stealc_tofsee.exe C3E62CCCEC1A6F3464D6326D112C2F4DFA1E8F0409E32A68A85031C898462FAFDCDD83EDA00C233743BF7065CE2967DF988A12D4F1A923AA7EB7334289073AA7
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4868

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

887.tmp

Path C:\Users\Admin\AppData\Local\Temp\887.tmp
Size 468KB
SHA256 47c9cfaef09892b39dd308efc3f6afaa446ddbeb543deea7cfb28bbf775daf9a
MD5 3129260f7869507b3464f86cef09e4cf
SHA1 f2cf8960982e1dce537693094c66bcd196fc3ae5
SHA512 24d4a6f8f85736ca965e872de79506dc35ff26f73f5657a6b3f2601b670ab4f9dce1b45ea022536906ab9cbe977c892bc20438b5b5e8874a0a2e0cc10ebcf791
SSDEEP 12288:qO4rfItL8HG7y3B6ZK/7dFZNGNi2J4Wjo3ZK7bWmeEVGL:qO4rQtGG7hw/pNCiPJKumeEVGL
TLSH
T12EA4E1267241C233D69302754FE7E6666A3E76B10726A8C73BD803BD1E616E2D336347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download