10b8fb7f5b6461276b65cb9a67b27f692ea69286105c1d6bf03cd94c7a37483d

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 10:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_7ea233848d07dea09d2f509b987f8d75_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260603-m2e13aex5m
SHA256 10b8fb7f5b6461276b65cb9a67b27f692ea69286105c1d6bf03cd94c7a37483d
MD5 7ea233848d07dea09d2f509b987f8d75
SHA1 3fd1209c11f81109a6fa0504f9650e16e64c9aba
SHA512 c6646d76ac784a347ab7c846f28511466179103d54455c2dbf3d1f4894ee39329ab52d263ae259237c832a9fe2f592004d5617dcce788681d15c8ba549904cd2
SSDEEP 12288:aO4rfItL8HRZVVP+1hTzf8YpdqSX7Ae7K9wlsDpVFd:aO4rQtGRZzPaxr8YKSX7Ae+9wlsDpVFd
TLSH
T120A4F12A3681C233D29301341BEADBE6A63E7574436694C737D4027E1F65AE1D37A38B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4300	3B9D.tmp

Executes dropped EXE 1 IoCs

pid	Process
4300	3B9D.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_7ea233848d07dea09d2f509b987f8d75_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3B9D.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3520 wrote to memory of 4300	3520	2026-06-03_7ea233848d07dea09d2f509b987f8d75_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_7ea233848d07dea09d2f509b987f8d75_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_7ea233848d07dea09d2f509b987f8d75_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3520
- C:\Users\Admin\AppData\Local\Temp\3B9D.tmp
  "C:\Users\Admin\AppData\Local\Temp\3B9D.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-03_7ea233848d07dea09d2f509b987f8d75_elex_mafia_stealc_tofsee.exe 7B7AE56025C4DDB4CA68331DBFB75047345432E1C925665F2A5FC550715B4F39D8738EB634ABEE3620F010419C176207F9D07AF6FBEC58E34C04435B4C88FE15
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4300

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3B9D.tmp

Path C:\Users\Admin\AppData\Local\Temp\3B9D.tmp
Size 476KB
SHA256 c46068b870e091c361697879f0945d28cf6f5272c91d3797f9809a323773880b
MD5 c8b3d300a109130fb918c9d57f8e1c56
SHA1 6b5c1661e17bdc640b35dbf6709cd43aa0ef3828
SHA512 2d175c4bdbdd5c1bfb639b2900e7472d1f8904cb15b5e9b2eb244f88fe438ed7a4c0f48291f89129ca348cb56fb4750a37ba83e342d4ac55d0f3802b5e7fdb63
SSDEEP 12288:aO4rfItL8HRq6LDiz3lj+rnF/A4lzITUXDmjD/7K9wlsDpVFd:aO4rQtGRqMi1j+LXl8Aq/+9wlsDpVFd
TLSH
T146A4F12A7641C233D2A302310BD7D7EAA73E79B00726A4C72BD4426E1F61AE1D776357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download