d0d58d0b8e64af4500a46a3bd6653aba3e5f5c84d1c290e66267e27ea7e176fd

Analysis

max time kernel
149s
platform
windows11-21h2_x64
resource
win11-20260513-en
resource tags

arch:x64arch:x86image:win11-20260513-enlocale:en-usos:windows11-21h2-x64systemwindows
submitted
06/06/2026, 12:34

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260606-pr95kaes8v
SHA256 d0d58d0b8e64af4500a46a3bd6653aba3e5f5c84d1c290e66267e27ea7e176fd
MD5 102465aa5e79e44d2ef0787200f9bfbd
SHA1 b894146c3cf613e6c9123a9efcf29401117a6bae
SHA512 5fbc81cb238f7fa8122b6dd1b0d20bd153bbf8baa3d623bbec4ba9f01f6cdd4c839239f89109813ed820d657167eca2272b335d2959228c21b834bc687d56f31
SSDEEP 12288:bO4rfItL8HAUQX6/9YZS081y/6jg70aC9coQrkoVh75UO:bO4rQtGAdq/3ljg7/C9cSoVhVUO
TLSH
T187A4F12A7681C133D29312750BE6DBAAAB3E3975032664C33BD442BD1F61AD1D73634B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3604	6462.tmp

Executes dropped EXE 1 IoCs

pid	Process
3604	6462.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	6462.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1032 wrote to memory of 3604	1032	2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe	81

C:\Users\Admin\AppData\Local\Temp\2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1032
- C:\Users\Admin\AppData\Local\Temp\6462.tmp
  "C:\Users\Admin\AppData\Local\Temp\6462.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-06-06_102465aa5e79e44d2ef0787200f9bfbd_elex_mafia_stealc_tofsee.exe 252C2DABA8AA4438CFA2DC032C2F7B72EEC3C42721AA31E2EBD545C1B83036FFC78AEF47BB7D07F39A68D5E18D5873F4C4570E24BC61555ADD26045F5B8B3596
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3604

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

6462.tmp

Path C:\Users\Admin\AppData\Local\Temp\6462.tmp
Size 479KB
SHA256 794d35aef320886bfa22782e5bf264f31b49802689f4506ac048d8eccee51a3b
MD5 2357a20ce6964a13d5e539ba61e6a315
SHA1 0ad11df22405f801d1408f42082b05b40371ea6c
SHA512 b6254676cd49a27077347668ea182ec5b96b02808c1daadff50d67abb421cffedbe9a978372dc81a8de37a33743e6ceca7c94116586bc7d3d3fe440ac4d2bef0
SSDEEP 12288:bO4rfItL8HAAUJTD05bf0vobvSxsLJvJ9Pki75UO:bO4rQtGAeWobikJvHkiVUO
TLSH
T19FA4E02A76818033D28301755BE6D7A6BB2E79B50725A4C33BD4023D2FB16E1D77A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download