93ee8107d4d7b50474f578ed57c56ebe55410287635a42da85927997ffaff3eb

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 15:16

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_e8200761cfa5086497b75ae720916eb7_elex_mafia_stealc.exe
Size 435KB
Sample260603-snt6qaav71
SHA256 93ee8107d4d7b50474f578ed57c56ebe55410287635a42da85927997ffaff3eb
MD5 e8200761cfa5086497b75ae720916eb7
SHA1 63e814841c83d1b0397202094697d2a3769bcf18
SHA512 ac60433e9257e0a831934b995b8953d8003856aa07827b6efaf7cfac2034d7c758fde7ca4167c9d7d498a19c4f85e821ecc8dcc86e19426d1f58ea557b453a00
SSDEEP 6144:98Xyq4o4aRCTuuqepiq+zQ1mBY8AOfLw2n3BnUQF8nyOyA+acJK:9W4ufepiqKQ1msO8yxnL6+acJ
TLSH
T13F94E0253242C037E1E716394BE5CBA9597E7DA14B25A4C73BD42BAA6F702C1DB3034B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3648	3062.tmp

Executes dropped EXE 1 IoCs

pid	Process
3648	3062.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_e8200761cfa5086497b75ae720916eb7_elex_mafia_stealc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3062.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2828 wrote to memory of 3648	2828	2026-06-03_e8200761cfa5086497b75ae720916eb7_elex_mafia_stealc.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-03_e8200761cfa5086497b75ae720916eb7_elex_mafia_stealc.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_e8200761cfa5086497b75ae720916eb7_elex_mafia_stealc.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2828
- C:\Users\Admin\AppData\Local\Temp\3062.tmp
  "C:\Users\Admin\AppData\Local\Temp\3062.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-03_e8200761cfa5086497b75ae720916eb7_elex_mafia_stealc.exe BA31D9A844F2EC383814295D8D13CD742EF286280E2E7401F9BA8868D750A4DFEF57C8CD48C4C5163372167FF36BE94C05AEB26D2F86ED34451CADBBDAEBD4BA
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3648

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3062.tmp

Path C:\Users\Admin\AppData\Local\Temp\3062.tmp
Size 435KB
SHA256 5d0708661d487b5ac847c3a00d890a448420f1eecad1251b26db950ab959bf83
MD5 7e3a18496a19f62bdf6bc876856be648
SHA1 51f6d2f0c06814b342f13a051510b29f403430c6
SHA512 8edc61a558b36b8be0fbb3fd5e753df14ca79eda8024f5d3dd6f231543a822d72cd6f117a3e0ce6c1f3b08a30f815366b72f07551f8bfdf36926b59ea93f2710
SSDEEP 12288:9W4ufepiqKQ1mVZDTRnUI3XCelu3DtjllwQKhJ:9W4ufepiqhmHdnUICeY1Di
TLSH
T17E94E1213142C036E6A71A344AE1CBBA997D7DB54B31B4C77BD02BAA6E342C1DB35347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download