39bb053e038dba24262e8f6d540f19dff98dcb9e59fd8e047c2a750054c54b4a

Analysis

max time kernel
149s
max time network
97s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 01:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_8a2561be00c333cf667240ecccc18bc4_elex_mafia_stealc_tofsee.exe
Size 384KB
Sample260605-b7tkvsbt8n
SHA256 39bb053e038dba24262e8f6d540f19dff98dcb9e59fd8e047c2a750054c54b4a
MD5 8a2561be00c333cf667240ecccc18bc4
SHA1 ed5238de61f2099e55976a40ad2ee5bba6d01fc0
SHA512 6ef666d57da1e6b1f70ec46355db93bf8ce29db67933249a1082c2e5272ac8798058edea06f3e8837b8b2b72e07f592d787dba202837b88cc39815777acf7bfe
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHLodZHuQ1fb+GhzFqYK9rOmCEGWE/qEqQvRaXZ:Zm48gODxbzJodZHPzQt9tjGWECEqRXZ
TLSH
T15584CF247581C032E19701314AF6E7621A3B3DA68B6468D77BE47BAD9FB03D1A73434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1376	F02C.tmp

Executes dropped EXE 1 IoCs

pid	Process
1376	F02C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_8a2561be00c333cf667240ecccc18bc4_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F02C.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
1376	F02C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2312 wrote to memory of 1376	2312	2026-06-05_8a2561be00c333cf667240ecccc18bc4_elex_mafia_stealc_tofsee.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-05_8a2561be00c333cf667240ecccc18bc4_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_8a2561be00c333cf667240ecccc18bc4_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2312
- C:\Users\Admin\AppData\Local\Temp\F02C.tmp
  "C:\Users\Admin\AppData\Local\Temp\F02C.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-05_8a2561be00c333cf667240ecccc18bc4_elex_mafia_stealc_tofsee.exe 93BAD67D6A4EEF470E81348251106D1DDE335F1D0C245FE153C6D0803F90C15537B115135B09C5F0BAEFCE3222A0B1CC7DC3D72D7FCAFE517E0D5DA94D80AA1C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:1376

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F02C.tmp

Path C:\Users\Admin\AppData\Local\Temp\F02C.tmp
Size 384KB
SHA256 2f48c1b7c3a55a7db5d844021a44bd00d1b4e3050ac3037eb685f4527f9ecc22
MD5 61edd5d8f6c348394dbef936601ee7ab
SHA1 12cf5beea97498f33cdead0ce475aa08c81675a6
SHA512 1d7bd80e285b87fa4eeddcab74d80cce85bfdea076bb5f87585eb68cd0bdcd4d022f917e0510a06fd03ea1597b76123b68aebb9650fa0277a011d882f90d0146
SSDEEP 6144:drxfv4co9ZL3GBGgjODxbf7hHdJmM4PWtyCRr0F67Jl8f1Z:Zm48gODxbzJmWIFY8dZ
TLSH
T10484CF247580C032E59701354AFAEB62293B7CB24B6168D77BE47AAD9FB03D1A734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads