962441d6884ec86b54b011ef867ee2734e3ad6586159235bd6c32d1e6f924f48

Analysis

max time kernel
149s
max time network
152s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 12:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_efc03fe15fbf18c9ed50295904360cda_elex_mafia_stealc_tofsee.exe
Size 473KB
Sample260604-pf4hmsfs4m
SHA256 962441d6884ec86b54b011ef867ee2734e3ad6586159235bd6c32d1e6f924f48
MD5 efc03fe15fbf18c9ed50295904360cda
SHA1 b061e75eee94e756357d98c0962d959b70e36b34
SHA512 fc59bb623ed98920eaa61dde8b4a4c4c77d6ed92f7a11a4eb41e2414c44d583e3b665591a52e96ba195005adf56a88705ff81d4c59db193acc6641da1cd6211c
SSDEEP 12288:Nb4bZudi79LCx32LSQgagX8kWn52PQnuA0a:Nb4bcdkLGQgagXo4M
TLSH
T1DCA4E1253182C037D29716344BE6C7E5563A7DA19F2268DB3BD4376E6EB02E1DA3031B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4716	36EA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4716	36EA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_efc03fe15fbf18c9ed50295904360cda_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	36EA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3960 wrote to memory of 4716	3960	2026-06-04_efc03fe15fbf18c9ed50295904360cda_elex_mafia_stealc_tofsee.exe	80

C:\Users\Admin\AppData\Local\Temp\2026-06-04_efc03fe15fbf18c9ed50295904360cda_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_efc03fe15fbf18c9ed50295904360cda_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3960
- C:\Users\Admin\AppData\Local\Temp\36EA.tmp
  "C:\Users\Admin\AppData\Local\Temp\36EA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-04_efc03fe15fbf18c9ed50295904360cda_elex_mafia_stealc_tofsee.exe 9838C2F1DA70BAC7A38AD726760B151E987C419D31C10CB11A9A99FD70CD68386FCEFFE4C4BB010AE96A850ED1C4D278A1CBE911911B04816B214EE87240350F
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4716

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

36EA.tmp

Path C:\Users\Admin\AppData\Local\Temp\36EA.tmp
Size 473KB
SHA256 0359811f3c7020ebf6bfbf4d0fa84b0987a87fb7314cfd3de36c8f8bc112ad2f
MD5 2f0119e4a6fda50d2b364b3502eda26d
SHA1 2904a59a4cda901311f0e10223fdc792d8469983
SHA512 2aabfda3176a5582ffae9ba1bc90289b788003a44765982a97ae4c78d7a14ae92cacfe223bc99dea8b179ceaeacc47f009bcb665327dc0fc971c75f92cde1dc5
SSDEEP 6144:fFrJxvldL4c5ONK1xgWbd1s79+iStWBnXqoLFveTJGZYT8l2HwcXue4zd9gRBCY3:Nb4bZudi79LdBXryXueA4BnkFAGR1A0a
TLSH
T1E1A4E0243581C037E19716344AE5C7B5663E7DA14F61A8CB3BD43BAD6EB02E2EA34353
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download