3bf25b5961b7dd34c35a38fe2fb88fb4efbb312c8328123d3246c7773f8b3406

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 14:51

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_a7a113be11583e5d6424bfd48809b1db_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260603-r8fndshz21
SHA256 3bf25b5961b7dd34c35a38fe2fb88fb4efbb312c8328123d3246c7773f8b3406
MD5 a7a113be11583e5d6424bfd48809b1db
SHA1 b6262174281de220e84c152280a95c80d75a93b1
SHA512 5d9d31a61c386d1bec5d12e1146b20cf9461fb9cafdaf4098d476a078e0adec86a5bd159736799cfacc6681d0b0bcc8ee82746ec3d084c5115d8af789f30ea61
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFMVe6CC2mqooyWxufIFiGPclmIPqvqHI:gZLolhNVyEThC2oMAF0AbqHI
TLSH
T1A394D029B6C1C032D19301314AF6D775653A7DB15B6264CBB3983B7E1EB13D0A67A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2200	6230.tmp

Executes dropped EXE 1 IoCs

pid	Process
2200	6230.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_a7a113be11583e5d6424bfd48809b1db_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6230.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2200	6230.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5004 wrote to memory of 2200	5004	2026-06-03_a7a113be11583e5d6424bfd48809b1db_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_a7a113be11583e5d6424bfd48809b1db_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_a7a113be11583e5d6424bfd48809b1db_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5004
- C:\Users\Admin\AppData\Local\Temp\6230.tmp
  "C:\Users\Admin\AppData\Local\Temp\6230.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-03_a7a113be11583e5d6424bfd48809b1db_elex_mafia_stealc_tofsee.exe 2A0A7AC68625D8971487597C81BF982DD847C0D7F00741C27E2548634B6F7EB80DEE2EF388AC23EEE2B61FDF25776879B9D801EFE7B9D16271CE5C8DE0C57731
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2200

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6230.tmp

Path C:\Users\Admin\AppData\Local\Temp\6230.tmp
Size 411KB
SHA256 16ed1df347f6c894c63dbd54a6ddc1ed586e181db578b44e6d7e9691fcffae6f
MD5 d1154988d2aff4061be8dcd340679c6b
SHA1 0b0dba80a799328dd1d0286faf669e699ed98747
SHA512 a3f4210803c75124180ae803aed46072dda8bef9ed6d391cc5bfb4f5e267f3b537b67d495123a8b936d57b798e4fd27b5b0c6b935d6c74a3c9af32b6e2019251
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFSzkLJLFFQUgTVnBvn3IXh6Vc3qHI:gZLolhNVyE5zu4RTVnSXhPqHI
TLSH
T10994CF24B2C1C032D59301314BE6D776153A7DB55B62A4CBB3D83B2D2EB43D1AA7A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads