eed357aed5f2d5e28d903f4911cab19e7c165cc3037866785fb229c1d49f8480

Analysis

max time kernel
149s
max time network
151s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 10:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_5a2e6e638525c711d7b36471bf38f7a8_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260603-mtc7haev3n
SHA256 eed357aed5f2d5e28d903f4911cab19e7c165cc3037866785fb229c1d49f8480
MD5 5a2e6e638525c711d7b36471bf38f7a8
SHA1 8e4bb21bbf05ca35405a9a9b16d05ef7c9167c14
SHA512 e236761019d5fa4d21a7b08c27dab40664975823d7ed1ae67ce792e7224b9579d349f597d6df00632df82d9984c7b2b962afb66def9968e7fa08d59fdd739156
SSDEEP 12288:aO4rfItL8HR7d4wuLJmPkwvZHvvt5Yi1tSlB38b+YR7v7K9wlsDpVFd:aO4rQtGRR4wRZHnsEclBsHV+9wlsDpVT
TLSH
T1D6A4F13A36818133D39211754BE6CBEAA73E75B1072694C33BD8066D1F61AE1D33A357
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
6092	1558.tmp

Executes dropped EXE 1 IoCs

pid	Process
6092	1558.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1558.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_5a2e6e638525c711d7b36471bf38f7a8_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3732 wrote to memory of 6092	3732	2026-06-03_5a2e6e638525c711d7b36471bf38f7a8_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_5a2e6e638525c711d7b36471bf38f7a8_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_5a2e6e638525c711d7b36471bf38f7a8_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3732
- C:\Users\Admin\AppData\Local\Temp\1558.tmp
  "C:\Users\Admin\AppData\Local\Temp\1558.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-03_5a2e6e638525c711d7b36471bf38f7a8_elex_mafia_stealc_tofsee.exe 8A4297FE2F8652D2C5CBB0B921DBEAC52E7A95DEDCBB7D53FCDBF121590ED6678F0DA8062B3B53F511484D230B02711FD5F1C0C4F208978ECA7B4E1627BB90EA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:6092

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1558.tmp

Path C:\Users\Admin\AppData\Local\Temp\1558.tmp
Size 476KB
SHA256 7e6006187e17e3b5db0b6ef5fd8d8af4d549465cac90e14b309c2ad87b3b2a0f
MD5 64a013e030bd423306311caa37ebae06
SHA1 0a092b758be6d0232b6d1536e8ed01ac4a190914
SHA512 c3711fc47f21a70cd56d392ef50238b26feb93c8544f4f002684e52a27cb52f103913a693eb91a09c04bf39e96a61265601cf47b49e8ad6adf7bd791da5c4b4f
SSDEEP 12288:aO4rfItL8HRGatMaoLgqctcC+7K9wlsDpVFd:aO4rQtGR1uC++9wlsDpVFd
TLSH
T1BFA4F12976818233D29302750BA6D7D6A73EB9B44776A4C73BD4027D2F60AE0D37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download