93cd217c7ca4a22e885ee0c8c96d57bffdbaa2b14654f6a1cac8ce356060727d

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
03/06/2026, 15:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-03_eb6980e5799dc769eb4819b0cd6a1963_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260603-spfpqaav91
SHA256 93cd217c7ca4a22e885ee0c8c96d57bffdbaa2b14654f6a1cac8ce356060727d
MD5 eb6980e5799dc769eb4819b0cd6a1963
SHA1 fc6ac5a8e2c7be9552f72e89c556421629ef679c
SHA512 23942f988f7ff180cce44da814d1e7286dcea61c0dce3df28dac895d33e6709c688078447659f27ddd34730344db67032ec6fa8c2257510980fad90214d1f01b
SSDEEP 12288:Nb4bZudi79LGC4loVUhsX+3R7zrtwl1zMpAX0PeqLrA0a:Nb4bcdkLf4lk27N2X026u
TLSH
T1AEA4E0243682C037E25316354AE1DBB5667A7CA14F7168CB3BD43BAD2EB12E1E634317
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4712	6E84.tmp

Executes dropped EXE 1 IoCs

pid	Process
4712	6E84.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-03_eb6980e5799dc769eb4819b0cd6a1963_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6E84.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1444 wrote to memory of 4712	1444	2026-06-03_eb6980e5799dc769eb4819b0cd6a1963_elex_mafia_stealc_tofsee.exe	82

C:\Users\Admin\AppData\Local\Temp\2026-06-03_eb6980e5799dc769eb4819b0cd6a1963_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-03_eb6980e5799dc769eb4819b0cd6a1963_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1444
- C:\Users\Admin\AppData\Local\Temp\6E84.tmp
  "C:\Users\Admin\AppData\Local\Temp\6E84.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-03_eb6980e5799dc769eb4819b0cd6a1963_elex_mafia_stealc_tofsee.exe E53E09E481F040CABF4D281AC471C5F3E1AEDF481407BBB59EB5239794FF6C3EABA664CF1D2C82C86A3C8F9946E710CE8BE0320F5DEF7C58BD86B95D0ECE3590
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4712

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6E84.tmp

Path C:\Users\Admin\AppData\Local\Temp\6E84.tmp
Size 473KB
SHA256 d5e434cc13e0c00b6afb58f066e36cb803b95900e1c6781440590e56f697bd85
MD5 9377daff8dec8fb280be8cd2d29eb16e
SHA1 d6dd754b7fb481c2d5b5ddbe4942c9ac22af5749
SHA512 fe86c0af051629fb769a4a92d145055082d075f0298bf1ed8793eb0780f82d96be248fd86fbec2759d3bb6a49bf717387782427b68c343baebbc8e396364c8fb
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStdgZUyAdYOWPXi/3uN3jk7utz4bFQl10PxS6:Nb4bZudi79LXiyABw63lO0PiA0a
TLSH
T1C3A4E0203282C037E1A706354AE6C7F6663A7CA15F66A4CB3BD437AD5EB02E1D634317
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download