8da9a9aadc7f8807732d1dbe77f371aa55a7f4b3c9e269cf9bd1de6dfc24fa7a

Analysis

max time kernel
149s
max time network
98s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 15:01

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_bc166fb8248881ba7dbf7dbbf49493c7_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260603-sd7n3abs2q
SHA256 8da9a9aadc7f8807732d1dbe77f371aa55a7f4b3c9e269cf9bd1de6dfc24fa7a
MD5 bc166fb8248881ba7dbf7dbbf49493c7
SHA1 2332a3d4d8a5306b251a6f974347b65ab37ecc39
SHA512 43a7b6c4524d2c80065a7e6ad115fc28bb2f2edba561334e37db06535e966a847376a19033417881ccd5e0d77b48a83b0ce7b6a1cc26e4e90492c3203ffea63e
SSDEEP 12288:U6PCrIc9kph5qCBC8ztYYrXSfCSjhkJNOu:U6QIcOh5qCBLtYYrXcjhkJNO
TLSH
T14894E0343581C036E29306348AE6DB67293E7D755B66A8D73BD42BAD6E303D1AB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
72	701A.tmp

Executes dropped EXE 1 IoCs

pid	Process
72	701A.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_bc166fb8248881ba7dbf7dbbf49493c7_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	701A.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
72	701A.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3200 wrote to memory of 72	3200	2026-06-03_bc166fb8248881ba7dbf7dbbf49493c7_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_bc166fb8248881ba7dbf7dbbf49493c7_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_bc166fb8248881ba7dbf7dbbf49493c7_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3200
- C:\Users\Admin\AppData\Local\Temp\701A.tmp
  "C:\Users\Admin\AppData\Local\Temp\701A.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-03_bc166fb8248881ba7dbf7dbbf49493c7_elex_mafia_stealc_tofsee.exe 175648143C807D3BB1CA9008B0B2527DFEB61B5FB6951F3710FBA1048E776655C46B0532DDB581F0383672D552A99D262960B867798BF36DC2C1355680E70609
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:72

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

701A.tmp

Path C:\Users\Admin\AppData\Local\Temp\701A.tmp
Size 412KB
SHA256 23a6daf7edcfdf8976ac3ef21f156e5fd48035001c2b0e2a08e920386a676697
MD5 1156d7056e3c1668c62b31637a3f7f78
SHA1 1b05e99b22ea78b8cb33f94a8311a453ed694064
SHA512 801ab3f848906f562492479bc054a41648cb2b1a68e6f8ae65c8a9489c88d309188d3191158f850d451553b8bb8c3a67f6e067097f07eb497d78b4ef53ac83de
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnJMohOg0jw9sKvo1ZnPgwf1f05WHXitP:U6PCrIc9kph57Mohp0jSsNZnhfnSl
TLSH
T1AB94E0243681C037E19212358EEADB77193A3E755B2168C77BD46BAD1E703D2AB39307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads