9d148dd7e625856f92f1d056a06f3b057bdf9f8779676df887c032eaade2c42a

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 14:55

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_2f141971725ad1a377dff154131bf0d4_elex_mafia_stealc_tofsee.exe
Size 428KB
Sample260603-samjqaaz8l
SHA256 9d148dd7e625856f92f1d056a06f3b057bdf9f8779676df887c032eaade2c42a
MD5 2f141971725ad1a377dff154131bf0d4
SHA1 1e08fe56b1079e675e9b7e351777de06d0d5c9d3
SHA512 bbd054ca54db504b10a3c8249bef10b655ff477a8392ba1fba229706f853445096503ccaa4c1ac3de831a4281aa862c908bd871fe1d5f221a485faea419daa8c
SSDEEP 12288:Z594+AcL4tBekiuKzEr4RTegFuNRwoj2SB9vIl:BL4tBekiuVrEDANRBjDJI
TLSH
T1E894F0323182C033E6A715344BE6CB6A557E79B54B2668C77BD02BBD6EA02D1D33434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5384	49B6.tmp

Executes dropped EXE 1 IoCs

pid	Process
5384	49B6.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_2f141971725ad1a377dff154131bf0d4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	49B6.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2864 wrote to memory of 5384	2864	2026-06-03_2f141971725ad1a377dff154131bf0d4_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_2f141971725ad1a377dff154131bf0d4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_2f141971725ad1a377dff154131bf0d4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2864
- C:\Users\Admin\AppData\Local\Temp\49B6.tmp
  "C:\Users\Admin\AppData\Local\Temp\49B6.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-03_2f141971725ad1a377dff154131bf0d4_elex_mafia_stealc_tofsee.exe FEBCC341E26B546569DB76A60C105C38D5F4B8E16B0081D0F40461294C7ED1A40BCAD6FF350959C9A0C75C543269E41F9B56934D2E4CCEEE4F125F1B5665CD34
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:5384

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

49B6.tmp

Path C:\Users\Admin\AppData\Local\Temp\49B6.tmp
Size 428KB
SHA256 fc9280e1e1c417964b228b0442d5ff9047047b62b2866b5a493ea8f8100237cb
MD5 8538aa7a6c525ae88e731d7021e0b368
SHA1 fa875cccb43bf7645f25e3c9c5613832d7ed7cc9
SHA512 99130e5be781864fdfd05311e9dee65b4b9c9a6dacb92ac4c5957823c4710aa81ddc6d4b241eb335dbedf1ce3ea66ee910910a5f26f06ae66081197a41231ba8
SSDEEP 12288:Z594+AcL4tBekiuKzErVHaOtzHodQEdWEczdlAYDGsZ7l:BL4tBekiuVr/toFdWEcdSYH
TLSH
T12B94F0353992C033E2A725344FE6CB66157EB5B24B26A4C73BD01B796E602E1E734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download