f83e51e45f72f1e251ae89066418d2d1fd60dbd2cd144a4be78b78a2f32ac2c3

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
18/04/2026, 15:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-18_620d3f2f7b475d1d0c13c66fc86efaf3_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260418-slecgsct7r
SHA256 f83e51e45f72f1e251ae89066418d2d1fd60dbd2cd144a4be78b78a2f32ac2c3
MD5 620d3f2f7b475d1d0c13c66fc86efaf3
SHA1 41144d0925ed6295c3a0e511f339bc37219a13d6
SHA512 1180a5b46c2107c2f89a05ff9be74f8016fb0f3a026e0b1ded26f25a9354412221d88cf596345dc2189e9478b9cb7d1f0476c38ece95b7808a8faab1354cade0
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFMEncH5inm+a05ZrL8ksL7xPdKBmaDf5TnkJ9qHI:gZLolhNVyEvH8m+nbcAEaDhTnMqHI
TLSH
T1E294D029B2C1C036D19201318BF6E776153A7DB19B2165CBB3983B7D2EB13D1A63931B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2556	1652.tmp

Executes dropped EXE 1 IoCs

pid	Process
2556	1652.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-18_620d3f2f7b475d1d0c13c66fc86efaf3_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1652.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2556	1652.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2556	4748	2026-04-18_620d3f2f7b475d1d0c13c66fc86efaf3_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-18_620d3f2f7b475d1d0c13c66fc86efaf3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-18_620d3f2f7b475d1d0c13c66fc86efaf3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Users\Admin\AppData\Local\Temp\1652.tmp
  "C:\Users\Admin\AppData\Local\Temp\1652.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-18_620d3f2f7b475d1d0c13c66fc86efaf3_elex_mafia_stealc_tofsee.exe 2B79860FD4EFF18AFCB95EE6AEC4EACBA4DA4274D8253162B84B3C280231C7133B11F550321E0A6375E0A3005BB9F679E83BA7B4372254A30605E86FC274DCAC
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:2556

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1652.tmp

Path C:\Users\Admin\AppData\Local\Temp\1652.tmp
Size 411KB
SHA256 2360747fe0194d26a08df84dbde0d4e929bb8b8d623b5bc3a2c8da4c22e13dbb
MD5 84df8e54e3888833f9a351fe1739a4e0
SHA1 11aaf63ea02d840ef2d9c0bcba3495cc45947da4
SHA512 990e5b47e279641010676bd0dd4b817a44b7b41082296eca318878124b6cc34b1d013d4fa8e2118d58ed0eed0f1483d74274256e64f4ffc2b4abea28a928da2a
SSDEEP 12288:gZLolhNVyEpNki7RXev0q/JnySbxTEzqHI:gZqhOEpN1k02n3xTEf
TLSH
T12C94D025B281C036D19301318BE6E776153A7DB55B6264CBB3983B7E1F743D1AA3A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads