542282e7f708938d8c3745560440db050275fca1aedcec2651bdb59258bc23e0

Analysis

max time kernel
149s
max time network
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 10:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_c8167cb3aedbbe155e85a81b991bc9d4_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260603-mwpcjsds4x
SHA256 542282e7f708938d8c3745560440db050275fca1aedcec2651bdb59258bc23e0
MD5 c8167cb3aedbbe155e85a81b991bc9d4
SHA1 0f86b016759c768c086df6375ac08065cb154252
SHA512 665a1496d9a71dc9c264875c96f9057f9b3e2c6470c1cdcb9f6f3e003b0bfe10e2c20f2744b69e9f64e966b2fcb7a67dcdeaefe0d3aa3d83f27de6c89353cf38
SSDEEP 12288:bO4rfItL8HAKyZ+YQ/DGY+hvZJF1t0DT75UO:bO4rQtGAlZhQ/X+hRFtuVUO
TLSH
T1F9A4F1267680C133D29302355BEADBA5BA3E79B45366A4C337D4427E1F206E1D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2624	6368.tmp

Executes dropped EXE 1 IoCs

pid	Process
2624	6368.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_c8167cb3aedbbe155e85a81b991bc9d4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6368.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 716 wrote to memory of 2624	716	2026-06-03_c8167cb3aedbbe155e85a81b991bc9d4_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_c8167cb3aedbbe155e85a81b991bc9d4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_c8167cb3aedbbe155e85a81b991bc9d4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:716
- C:\Users\Admin\AppData\Local\Temp\6368.tmp
  "C:\Users\Admin\AppData\Local\Temp\6368.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-03_c8167cb3aedbbe155e85a81b991bc9d4_elex_mafia_stealc_tofsee.exe FA17192ACF45F2B720663DDE4E35113F5F6BD2621314AF2EF041E540ACB1A14F3A18CACD589D5C7B1133A2E8F36C5C068D8E80637C7AC226668A2AD3A35DA59F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2624

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6368.tmp

Path C:\Users\Admin\AppData\Local\Temp\6368.tmp
Size 479KB
SHA256 88f73e4e8a0d0d4c331cd27257ea106d3a75380206dee38c1ffc4c7e80c6879a
MD5 1324de2c25290a9591f15dbc6e30544a
SHA1 ce5070d91c063dc78e5d9390c94d88e77ff86c4a
SHA512 4b8549a7462eb6baf06993bcc2b8a120303ee1aa3ee5cdc266b8adb2bfb261e5b68411185b869d81696f6f32a8ec7fbec0aea8dd9373dfd0b7d1350664ac0b20
SSDEEP 12288:bO4rfItL8HAgbxZDAOBOi+KqqLrWy6PavOLYX375UO:bO4rQtGA4jDBOPBnaGYHVUO
TLSH
T16FA4F126B281C133D29302351BD6DBA66A3E79751327A4C33BD8427D2F617E1D37A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download