540fd4aab6ee6b9038b1b03693af755a7f274578f5cb1f38c1c88a18e91a7844

Analysis

max time kernel
149s
max time network
128s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_4c4612834b083fbd7a44c47eb613cedd_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260604-st87tsas8j
SHA256 540fd4aab6ee6b9038b1b03693af755a7f274578f5cb1f38c1c88a18e91a7844
MD5 4c4612834b083fbd7a44c47eb613cedd
SHA1 0a7c73ee3aae25cb4fee37e395b6047a4d474057
SHA512 9918d4a12fe48d51414a63da7b8d75e4efbd2e543ee3bf0274fe580bdca6791f0eed8d498d1837522ea50a0bf4bb5bc303f4fde25a985c696075a5c9ad35ccaa
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvEhpEywX35TjDeIdvD65DpGTB/hkUjYppiai:Ci4g+yU+0pAiv+1yot+2wDpGYUign
TLSH
T1C394F1213442C033E1A719750BE4DBA65A7E39B24726A4CB7BD00B6E7EA07C1D739397
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3572	2630.tmp

Executes dropped EXE 1 IoCs

pid	Process
3572	2630.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_4c4612834b083fbd7a44c47eb613cedd_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2630.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3500 wrote to memory of 3572	3500	2026-06-04_4c4612834b083fbd7a44c47eb613cedd_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-04_4c4612834b083fbd7a44c47eb613cedd_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_4c4612834b083fbd7a44c47eb613cedd_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3500
- C:\Users\Admin\AppData\Local\Temp\2630.tmp
  "C:\Users\Admin\AppData\Local\Temp\2630.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-04_4c4612834b083fbd7a44c47eb613cedd_elex_mafia_stealc_tofsee.exe 4CFA8AEC579B923C09995F6B573D2ECBCEE55364E03BFC5001B3FDD837090856CDD1F71302FFDAFBAFD9F1B27809547E36FDA2C0E3E75286F59ED45D7486B859
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3572

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2630.tmp

Path C:\Users\Admin\AppData\Local\Temp\2630.tmp
Size 433KB
SHA256 8a1332d09e451b0a56b5b0febd353ebef16dc3a0fa18275da90dd70f27cf85d6
MD5 dda3dac28532755730dce59ac1677668
SHA1 0fb34c5d22021a90591ae5ae57e680f6a0dc5ebe
SHA512 af7f86ee92baadea2bca0d3388554fb6b10a2a0bd7df59b4203bb25d8b6240d3a304227e6088caf18ac30a566c7177302ba0c18fef5fbc628db65b38fdfa5442
SSDEEP 12288:Ci4g+yU+0pAiv+FrI3IxDwuzpl+rLRjXn:Ci4gXn0pD+VI3w5mLRj3
TLSH
T16194F1243586C033E2A705354BE5CB66697E78B14B21B8CB3BE01BBE6E606E1D735347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download