a6663f8b2d9792262e05af15962928c5c96c78b2318feb31f25d153c9f6bc07c

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
05/06/2026, 11:13

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-05_c9f6bf05fef6f58781701177efba89cc_elex_mafia_stealc_tofsee.exe
Size 412KB
Sample260605-nbv52ady5x
SHA256 a6663f8b2d9792262e05af15962928c5c96c78b2318feb31f25d153c9f6bc07c
MD5 c9f6bf05fef6f58781701177efba89cc
SHA1 a1ff9bf90351e2921d710f75bb5d7521d9e24d40
SHA512 9263bfeb79f5e01d6678274ddd5c9fc619f5f121e4426691801294f754065012c2d7b7356b4d4d7bc212fe8cf8d62d8c5d040dbea42b538959c7e43f888a691f
SSDEEP 12288:U6PCrIc9kph5t7Zepv3fS1WbH22bYrbA7YC7L:U6QIcOh5tFed3ECHhbsbW
TLSH
T11B94E0243581C037E29312318AEADB77193A7E654B22A4C777D46BAE5E703C1EB7434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2192	8CE9.tmp

Executes dropped EXE 1 IoCs

pid	Process
2192	8CE9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-05_c9f6bf05fef6f58781701177efba89cc_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	8CE9.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2192	8CE9.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2632 wrote to memory of 2192	2632	2026-06-05_c9f6bf05fef6f58781701177efba89cc_elex_mafia_stealc_tofsee.exe	79

C:\Users\Admin\AppData\Local\Temp\2026-06-05_c9f6bf05fef6f58781701177efba89cc_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-05_c9f6bf05fef6f58781701177efba89cc_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632
- C:\Users\Admin\AppData\Local\Temp\8CE9.tmp
  "C:\Users\Admin\AppData\Local\Temp\8CE9.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-06-05_c9f6bf05fef6f58781701177efba89cc_elex_mafia_stealc_tofsee.exe A6E2BD77A67C2D2A7AA9098174D1D5A393E6FA42D42BF6F1E284BF584DFC2D98BD5D0CF672A2AD2705EDFBAD0AE31EC1386696BFE234919B0CB204B177D8DC0E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2192

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

8CE9.tmp

Path C:\Users\Admin\AppData\Local\Temp\8CE9.tmp
Size 412KB
SHA256 df3b472d1795ee14c74ec10e86a12900ce5155ae694621f8173988389da9795f
MD5 2db6a9ae2997f2284164e13de2fd813b
SHA1 c7fd3b0cf60f30dff032ab102750ce915d14177a
SHA512 7c858e9c84114c28d5a5f7b836cc7c68fd6796ea542550f4d8a1ee0489318c4bc107eac450adcff9b1316cf5c0a6553cc2c2bedef310c141579d9aad31886c9f
SSDEEP 6144:UooTAQjKG3wDGAeIc9kphIoDZnABopVDMvS5rbwGBHLRY0yP3APZRJfpOP:U6PCrIc9kph5OBWDMvc5RYXf4ZPfw
TLSH
T1E794D0343285C036E5E706305AEADB661A3A7D754B31A8C777D46BAE2E702D2E734307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads