65a066c6abde2ead769c3b578d656e7def0c8e6754297ae5916e1a9a949b3508

Analysis

max time kernel
149s
max time network
153s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 11:04

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_912d0fbf220b17f8347edba586d95101_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260603-m6mlpsey5n
SHA256 65a066c6abde2ead769c3b578d656e7def0c8e6754297ae5916e1a9a949b3508
MD5 912d0fbf220b17f8347edba586d95101
SHA1 271f2efc72b5da5e34489ea2c002ba551da3b194
SHA512 3ff583a25c00ad144386a8137cfe145efad73b123641e42d5203fe61214072ea678a149ed706f7584e03b7e6a0ec833c9d9c16699ee45634b7bc5acbb8e29e74
SSDEEP 12288:3O4rfItL8HPk2JlC2aEj/dGgqu8Kn40sbn7rKxUYXhW:3O4rQtGPtQ2Zj4v3KxUYXhW
TLSH
T188B4E126B741C233D2C302711BE6EAA6AB3E79B1572694C337D4427E0F61AE1D375386
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4352	E3A4.tmp

Executes dropped EXE 1 IoCs

pid	Process
4352	E3A4.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_912d0fbf220b17f8347edba586d95101_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E3A4.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4216 wrote to memory of 4352	4216	2026-06-03_912d0fbf220b17f8347edba586d95101_elex_mafia_stealc_tofsee.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-03_912d0fbf220b17f8347edba586d95101_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_912d0fbf220b17f8347edba586d95101_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4216
- C:\Users\Admin\AppData\Local\Temp\E3A4.tmp
  "C:\Users\Admin\AppData\Local\Temp\E3A4.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-03_912d0fbf220b17f8347edba586d95101_elex_mafia_stealc_tofsee.exe 1665913C64E568F852242EFBC73D2502512D74F16AF559CFEBE7C166E7F593675F573A22F7F4DA215AEB476D3FC54192B9547DA789CAAB31E99A03409BB92AFE
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4352

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E3A4.tmp

Path C:\Users\Admin\AppData\Local\Temp\E3A4.tmp
Size 486KB
SHA256 2c5407e908e883dea1e60c7372c8a3c5e977c6027f5b527e1b961e01e81c7f56
MD5 415d2e47e5299895937c52a932d71ec2
SHA1 b8b904fed38e19e6ef379ed3b4138010a306659b
SHA512 396cdc4a51dcbb70effca88fd5a9c9b82366a3a2b6cb08fb84b8e7884de859d6667208e10e26a9b0e7615d2ca42deb73fa07705757d979d26857a05fde391b9a
SSDEEP 12288:3O4rfItL8HPGff6sVUy+jTOC5VocqikHt7rKxUYXhW:3O4rQtGPuSsOyyTO6VnqikN3KxUYXhW
TLSH
T1EBB4E12A76818233D29202745BD7DAEAB63E75B14336E4D327D8027D2E51AE1D33A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download