aa9d727b3dd39b62a041016c4e26bbc87da769a7535696b22b7355b226c47198

Analysis

max time kernel
149s
max time network
154s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_7da9c4d57b42252589de74a7198b952f_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260603-m2bzeadv2x
SHA256 aa9d727b3dd39b62a041016c4e26bbc87da769a7535696b22b7355b226c47198
MD5 7da9c4d57b42252589de74a7198b952f
SHA1 2f65a9a9a0762f06aadd51d67aeb13b3a0ad087e
SHA512 841f5f9b53aa3a916716a2c569f7ea0f80e56d920b297e91044673496619cba99604b4989ee3ab68257eb83106b22de421c47e2be490c4b733701469b790ea68
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnUEGUATvOJdMlgsOQ6dLZEvwxEP:U6PCrIc9kph5u3jEdMvyY
TLSH
T1A694D0243585C136E69305309AEACBA6193E7E654B32A4D737D46BBE2E703D1EB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5288	2565.tmp

Executes dropped EXE 1 IoCs

pid	Process
5288	2565.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_7da9c4d57b42252589de74a7198b952f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2565.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5288	2565.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2776 wrote to memory of 5288	2776	2026-06-03_7da9c4d57b42252589de74a7198b952f_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_7da9c4d57b42252589de74a7198b952f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_7da9c4d57b42252589de74a7198b952f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2776
- C:\Users\Admin\AppData\Local\Temp\2565.tmp
  "C:\Users\Admin\AppData\Local\Temp\2565.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-03_7da9c4d57b42252589de74a7198b952f_elex_mafia_stealc_tofsee.exe FD9EC9CA4454F4D1D02D40C823C88E448E3C00AB69A04473BF2E054AF13F72A8EE4FB229AAF1F0BAC4E457B7FB17BF36571DECC1C326C4FCA8FADC9FE5CAD13D
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5288

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2565.tmp

Path C:\Users\Admin\AppData\Local\Temp\2565.tmp
Size 412KB
SHA256 d7cb0e4adbefcea1888be457949de1a107d31da1f84c804d05de51b08235553a
MD5 32c071f020ad5ace504906c94f0bd03f
SHA1 318a477f1385cb1ecb2f9f9d3e6c1ab717ca168c
SHA512 961a644f6059a479d2c96ba0ad0c907cb47b07ce56b3fa3517ae3c496ab9b26101f22efd7c4b941707d343976d05070ba89aa0f7a91669f3b1f704eb4d0162ff
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZncgROU5+vbXIJ9fDB8F0ZVDh0NwywDbscEebP:U6PCrIc9kph5hOU5+DYJ9f9r0mvDwcb
TLSH
T1FA94E0243581C037E69315398AEADB66193E7E754B22A8C73BD467AE2E303D1E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads