87db08d1c6985132211ae4750340e8548ad29df7a976fb2df7275791ff1ff54e

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 14:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_19c0a53d6d29406beacd1046b0a5a531_elex_mafia_stealc_tofsee.exe
Size 526KB
Sample260603-rjsxesgz41
SHA256 87db08d1c6985132211ae4750340e8548ad29df7a976fb2df7275791ff1ff54e
MD5 19c0a53d6d29406beacd1046b0a5a531
SHA1 35fd0e72778cca4535b30ec8df75a4235c1d7b55
SHA512 3bd3d68d9cb4722b70ccba38c1fc970c35651ffb139b3cfa0ef5b1af2824a651ab6f83205c430c70b33bc07f712149e5a1d9bf19aa6d8cc7e205ae3b5f63eaf1
SSDEEP 6144:zooTAQjKG3wDGAeIc9kphIoDZnH7GcIelkOqwhFlksdkmPB9OPQYM6LnWI6UP6+:z6PCrIc9kph5lGiHlksemPPmNblz
TLSH
T1D1B4BE385585D2B1D2A383388CE9F69E4C34B501573AB0E7A3EC07AD99BDAD15F38607
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
8	5C34.tmp

Executes dropped EXE 1 IoCs

pid	Process
8	5C34.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_19c0a53d6d29406beacd1046b0a5a531_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5C34.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
8	5C34.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2720 wrote to memory of 8	2720	2026-06-03_19c0a53d6d29406beacd1046b0a5a531_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_19c0a53d6d29406beacd1046b0a5a531_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_19c0a53d6d29406beacd1046b0a5a531_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2720
- C:\Users\Admin\AppData\Local\Temp\5C34.tmp
  "C:\Users\Admin\AppData\Local\Temp\5C34.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-03_19c0a53d6d29406beacd1046b0a5a531_elex_mafia_stealc_tofsee.exe CE317C8AAAF4F7A8B561C21E581E1830D6D22AB88551C80BE7CBF511DB49D966A2637598BEEA339F923C22B2DD500986694435442B750F5CD45E1383872BC59E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:8

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

5C34.tmp

Path C:\Users\Admin\AppData\Local\Temp\5C34.tmp
Size 526KB
SHA256 c94186f6e47258daea545c748f9e331b73e7fe09c4ecf4b0a319d5eb1767c359
MD5 2bb540c83acf7527250b529bc615fd33
SHA1 3ac7dce5a11fc43799deab0bd0ebf1b6417af637
SHA512 c7a7af7b066c490fa17085f8912c0bad9da4fc9206e4f193b131fe54758fc489d2074cadf751bffd1aeb39ea724815d0e1450d89d982f5e835c620f0af939c3e
SSDEEP 12288:z6PCrIc9kph5GVc+v4WKhFLfbx67IVeft6vz:z6QIcOh5f+vNKjlia
TLSH
T136B4BE385185D2B2D2A383399CEDE68E4C34F511173A70E7A3DC07AE59BDAD05E3960B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads