83324f85decb2ca0cb43606625ce8daa1fc1a7e561628dcfc441ab073176a18e

Analysis

max time kernel
149s
max time network
150s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
04/06/2026, 15:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-04_10ea0bb76102aa6d0ff992e21422080e_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260604-synfxshy3y
SHA256 83324f85decb2ca0cb43606625ce8daa1fc1a7e561628dcfc441ab073176a18e
MD5 10ea0bb76102aa6d0ff992e21422080e
SHA1 f83fd36f5cd791631a80b08c0631544107a766b1
SHA512 835ca8767ae950098d12c44ca744fa56e55f57eb2b55d23dc97f9b207c46edbe9063f32adb3b53d96bdaf3878a7d1c3909ddd1b833cc7adf95ffac61a74b6780
SSDEEP 12288:qO4rfItL8HGHrky29eoZaCpdbcsCrRMXB/hiv8B7bWmeEVGL:qO4rQtGGHrkNeCjbcaXxh8QumeEVGL
TLSH
T119A4F1367241C133D19302754BE6DBAAAA3E79740325A4C37BD8067E2FA16E0D77A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2952	4CD3.tmp

Executes dropped EXE 1 IoCs

pid	Process
2952	4CD3.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-04_10ea0bb76102aa6d0ff992e21422080e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4CD3.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2108 wrote to memory of 2952	2108	2026-06-04_10ea0bb76102aa6d0ff992e21422080e_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-06-04_10ea0bb76102aa6d0ff992e21422080e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-04_10ea0bb76102aa6d0ff992e21422080e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2108
- C:\Users\Admin\AppData\Local\Temp\4CD3.tmp
  "C:\Users\Admin\AppData\Local\Temp\4CD3.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-04_10ea0bb76102aa6d0ff992e21422080e_elex_mafia_stealc_tofsee.exe A3C9A75F51CC8D6B00CF2E0BDDD755EF56FCDE0B1095E8A70CBC691F7BF389AC2993C011BD341AEF02BF33514C702DDACD9CDA477B87399DDE5B81E06C9536AF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2952

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4CD3.tmp

Path C:\Users\Admin\AppData\Local\Temp\4CD3.tmp
Size 468KB
SHA256 2b2f139f2b20a60734f140889599f6dbb289f4cf38910d0f0054bfe9cbf11c83
MD5 392a269fc352874a1cba16aca61966d8
SHA1 1e604f07f5f610373036066637748e64b42597b3
SHA512 6b5ab6d4a3c9cfbd587a39b4ce9a63e6f1cf5c83b81d896fe4f7f2dbbeea784af248362326d8fd838d4a69d467e07666a81ccdefc922cc53cfa3f65a4fe3cae8
SSDEEP 12288:qO4rfItL8HGcKyKufzvYwwoZbDODh67FL5iUk7bWmeEVGL:qO4rQtGGclzvYLsshAL5iUkumeEVGL
TLSH
T179A4E02A7282C133D28302751BE6DB9AA63E75B40372A4C37BD4427D5F656E1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download