41a47baac022758cc732cb8a232d6910d3df23d7c7628906cb9e956ce2a88f2c

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 15:07

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_a9ca7717106821dc3e56b36963cd1039_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260603-shffdabt5n
SHA256 41a47baac022758cc732cb8a232d6910d3df23d7c7628906cb9e956ce2a88f2c
MD5 a9ca7717106821dc3e56b36963cd1039
SHA1 813dfc05120384dc85abec64e2c5ceb1683b89a7
SHA512 136f9e00bce145dbba36bca10d162fec45c06916e2fef805376acacba5ad2b4c4d548e47f5b216ba399c880af2ec167146bf82298c9bcd145f75c653ee21b131
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFbaak33lgqUnpIWRdNHMR8VPsSl4kmqMMKqH:gZLolhNVyEekqp/Nc8BsdkuPqH
TLSH
T12D94D02572C0C036E19301354BEAEB76193A7DB15B6164CBB398377D1EB43D1AA7A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3708	459F.tmp

Executes dropped EXE 1 IoCs

pid	Process
3708	459F.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_a9ca7717106821dc3e56b36963cd1039_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	459F.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
3708	459F.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4444 wrote to memory of 3708	4444	2026-06-03_a9ca7717106821dc3e56b36963cd1039_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-03_a9ca7717106821dc3e56b36963cd1039_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_a9ca7717106821dc3e56b36963cd1039_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4444
- C:\Users\Admin\AppData\Local\Temp\459F.tmp
  "C:\Users\Admin\AppData\Local\Temp\459F.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-03_a9ca7717106821dc3e56b36963cd1039_elex_mafia_stealc_tofsee.exe 5BD42B2CD065E675CB12C518D5BAAE35D26CC1B24194832FEB7E938A359CA0C24B897EDA63A748BF1235CAA1545CB42158F5FC8260909A72414314B03D3DF12A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:3708

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

459F.tmp

Path C:\Users\Admin\AppData\Local\Temp\459F.tmp
Size 411KB
SHA256 eff2dcc1e40a566d296c8ec164e94fb08327bb4d17d0ddcb3976088d804d9aa5
MD5 5e61b53f1063428649824aad55e43097
SHA1 91928d13baa6503ab14ccc4c8a6351777e7271d4
SHA512 21a7392ce1964c05842c33bc98307aa1c3d9424fb11cf8c7fca27160cf20438df23ab19ffd71668fec1f65e0904076cfa0a97f78877851e19a0d0857a30c281a
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFpkDPMKXplxSgVec7Ag+aUVHB8OCYcqH:gZLolhNVyEXJXpFVD7ZnUoOCYcqH
TLSH
T1A894CF247681C036D19301318BEADB35293A7DB24B6164CBB3D83B7D2E753D2A67930B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads