bce3e54df5ee0599f4c53b470075a72867804a5340b1d0717eb4a231ecf4f925

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 10:33

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_3e104cdb9a7b5c744c2080b1ca04d8ed_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260603-mljdjscy3t
SHA256 bce3e54df5ee0599f4c53b470075a72867804a5340b1d0717eb4a231ecf4f925
MD5 3e104cdb9a7b5c744c2080b1ca04d8ed
SHA1 51c7a5faa45f241cad03cbdcdc85c24932840d77
SHA512 daa0d056958be0e5a111dde3c1db1c928201e4f3b99cb359f017236ad7a11dbfac75e930e5faa1a2a71e4934b2925d1a1f8d27950430009132dcd2e757d0f389
SSDEEP 12288:Ci4g+yU+0pAiv+dXREtRtwbN1W0FMtGtkatwan:Ci4gXn0pD+1ReMbhOwtkmL
TLSH
T18E94E1203592C033E2A219354BE5C79669BA79B14726A8CB7BD40BBE6FB43C1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3764	FA4E.tmp

Executes dropped EXE 1 IoCs

pid	Process
3764	FA4E.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_3e104cdb9a7b5c744c2080b1ca04d8ed_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FA4E.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5872 wrote to memory of 3764	5872	2026-06-03_3e104cdb9a7b5c744c2080b1ca04d8ed_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_3e104cdb9a7b5c744c2080b1ca04d8ed_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_3e104cdb9a7b5c744c2080b1ca04d8ed_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5872
- C:\Users\Admin\AppData\Local\Temp\FA4E.tmp
  "C:\Users\Admin\AppData\Local\Temp\FA4E.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-03_3e104cdb9a7b5c744c2080b1ca04d8ed_elex_mafia_stealc_tofsee.exe 45DA57928B1BB4C9A22C4037C952F68C4F6CCC3C498F6BE2D26EA14DA10978B02A2780DFFF80B511444487A44D56AF0E3816FF4B273DD1A3576B4FFE730AD259
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3764

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FA4E.tmp

Path C:\Users\Admin\AppData\Local\Temp\FA4E.tmp
Size 433KB
SHA256 3013d9096c10e2f4aa5b7385e85e652c760e18fe324274b1c9e9815e823239af
MD5 b0403cadf4b5e52b58a1763812ab3cdc
SHA1 19a209a9588b619c6a8ab4467a452a966d80ed34
SHA512 2cf9b4ac462714ccef183dbcfa8082dfadd3f31aaacfd4f5897b82e75ddf94874748d02c4a38ae82eef0c23561cf2905da3ad3fd09c46252339bf193505393aa
SSDEEP 12288:Ci4g+yU+0pAiv+A8AK92EPgCnxykFnXJGpW/wqamUn:Ci4gXn0pD+Am9Nzx9nj/d0
TLSH
T1AF94F1303482C033E5A71A354BE58B66297E79B24726A4CB7BD00B7E6FA47D1E634347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download