e711c005a4e124d54612a1ca281c21957b07c57341d873c25e4271a5eff84fc9

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
16/04/2026, 00:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-15_9e2af48ac7b225ef008766ef165b12f0_elex_mafia_stealc_tofsee.exe
Size 613KB
Sample260416-aak2saex9z
SHA256 e711c005a4e124d54612a1ca281c21957b07c57341d873c25e4271a5eff84fc9
MD5 9e2af48ac7b225ef008766ef165b12f0
SHA1 c99872a8a12d3275a42fc6f7d8bf7868568a8a63
SHA512 1a1c5a6761a661302df3cca91dbc726f9589470041f2fb54a45bc80e927bdf96113b7abd6bc7376a2db2483515be451244d8d9abd0841411b6839b77267f70ca
SSDEEP 12288:XO4rfItL8HPi8LiebA1axxEUHNH1+P4aDf+KIVIh7Q8mO4rfIt+2:XO4rQtGPi8LE1axmENV+P4STIVIhdmOL
TLSH
T1C7D4E025B740C033D5A511359BD3AB6A563A7DA40B12A1C33B842BBD7EB42E2D73934F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4608	E8CA.tmp

Executes dropped EXE 1 IoCs

pid	Process
4608	E8CA.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-15_9e2af48ac7b225ef008766ef165b12f0_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	E8CA.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4564 wrote to memory of 4608	4564	2026-04-15_9e2af48ac7b225ef008766ef165b12f0_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-15_9e2af48ac7b225ef008766ef165b12f0_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-15_9e2af48ac7b225ef008766ef165b12f0_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4564
- C:\Users\Admin\AppData\Local\Temp\E8CA.tmp
  "C:\Users\Admin\AppData\Local\Temp\E8CA.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-15_9e2af48ac7b225ef008766ef165b12f0_elex_mafia_stealc_tofsee.exe 7113410FE30ADE81CDAA47A29826379D116892DA5221C2DBFF2426BB034C356D401D58F1D4563F76941A3F16284CFF63F887DBFBC2E760A3235F420541D10035
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4608

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

E8CA.tmp

Path C:\Users\Admin\AppData\Local\Temp\E8CA.tmp
Size 613KB
SHA256 1d0da453a0e6813309625f7fcc0d0443e35d4b8787e2deee1ea5bca677428696
MD5 9fdb0a2a6cd130b93112fe487b1111ec
SHA1 9ea4e5996c19c3787ddf3c914c282f63114ecc81
SHA512 77b811b172942decdf92f43e6f57ff5f76d24916d9728c7223e36f16671df622c60e0e8bce3c856399a2e54c20a06c9869a5e08720cb5312b5b6a77899bc6538
SSDEEP 12288:XO4rfItL8HPKTCzp6wvKwb1jMc0Gl7Q8mO4rfIt+2:XO4rQtGPKOt6wvKw4edmO4rQt+2
TLSH
T1B0D4E025B640C037D2A511395BE3EB69567A7D740B12A5C33B8027BD6FB02E2D73938B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4564-4-0x00000000013A0000-0x00000000013B8000-memory.dmp

Download

memory/4608-5-0x00000000003B0000-0x00000000003C8000-memory.dmp