44dca48f753a67b2b2cfdb4c807a51b535307caaf880a85a0476cfca2b27c682

Analysis

max time kernel
149s
max time network
145s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 03:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_8b0e0fba19bc83fe568ba0b256f98d1e_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260420-djkddsby5s
SHA256 44dca48f753a67b2b2cfdb4c807a51b535307caaf880a85a0476cfca2b27c682
MD5 8b0e0fba19bc83fe568ba0b256f98d1e
SHA1 459635647f7cde09c42f7cb65fa8ddbf424ece77
SHA512 d109ab5dbfe04d282770a93215f0dfad3dac5ed14f4308407fe5edbabc042a80d779f5b0e376d4fcddd1345aafc65aadcee72a6c5c25d6c66c65e2ff9905f45e
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYpfAFm0t1vylzkr+FWU180GnjAU827l:Wq4w/ekieZgU66MmI16lYhF0wjNVl
TLSH
T19994E1213685C03BE1EB05358AE5CB6A5A397D650B36A4C73BD42BAF6E742C1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4264	2E9.tmp

Executes dropped EXE 1 IoCs

pid	Process
4264	2E9.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2E9.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_8b0e0fba19bc83fe568ba0b256f98d1e_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4496 wrote to memory of 4264	4496	2026-04-20_8b0e0fba19bc83fe568ba0b256f98d1e_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-20_8b0e0fba19bc83fe568ba0b256f98d1e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_8b0e0fba19bc83fe568ba0b256f98d1e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4496
- C:\Users\Admin\AppData\Local\Temp\2E9.tmp
  "C:\Users\Admin\AppData\Local\Temp\2E9.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-20_8b0e0fba19bc83fe568ba0b256f98d1e_elex_mafia_stealc_tofsee.exe A5DBE85BDE6361691337724DFA816945C8E971F47C732E2A6654A3E2E3C8DC1D3948B888737A937A243DDC33B8FE6A8F8D0B9142F8A086414B65FE5011ABA77E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4264

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

2E9.tmp

Path C:\Users\Admin\AppData\Local\Temp\2E9.tmp
Size 414KB
SHA256 5f93374d38396cc5ec004ddfcae33d0500962040bfb1a2297336b66c52864223
MD5 b0f6ad1bda6e42d75c327ccbed611bf2
SHA1 e0f4675e8cb63bcc4fb01fdc5c6c5af6f50f580c
SHA512 b6ea7e2bb009e5571f9ec3bb7a9051421d9aebcef0fa11133736cb21a5e803b31f5301dbc03efc05edc6536665541fdd614109659013439c971266b3d169f633
SSDEEP 12288:Wq4w/ekieZgU6fVMwg/cCx5Q4rmuFb+l:Wq4w/ekieH6fW+Cx5Brmup+
TLSH
T12D94E1257646C037E2A716384BE5DB69197A7D700B32A8C737D02BAE6E742D1DB34307
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4264-5-0x0000000002CE0000-0x0000000002D3F000-memory.dmp

Download

memory/4496-4-0x0000000000800000-0x000000000085F000-memory.dmp