7450eab6317057b43a9a50cb2fa0b675a2a2851c7599a46ea21e121c60185841

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
20/04/2026, 03:44

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-20_59099f3062e23c55e3b7fe51a6581e8f_elex_mafia_stealc_tofsee.exe
Size 411KB
Sample260420-eam9csgt3r
SHA256 7450eab6317057b43a9a50cb2fa0b675a2a2851c7599a46ea21e121c60185841
MD5 59099f3062e23c55e3b7fe51a6581e8f
SHA1 0a30aff2aa125360313d95c705b0c2f7feef4b6b
SHA512 9a8b582d24e123ea7dfc59998979596fbc76744ba74d9511ca0a76b6170ed6bad26549a21ce0f6bdfe3e3d1e0558b50127ebf8dbc31c5af12033fc1b3cd173d6
SSDEEP 6144:gVdvczEb7GUOpYWhNVynE/mFTH/nhjkuBmZdfu2UcwEtZ+xaHWjfBqH:gZLolhNVyEYBNlOHD+xawBqH
TLSH
T19C94D028B6C1C032D19201314BF6DB76153A7DA15B22A4DBB3D8377E1EB43D1A67A31B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
5632	105.tmp

Executes dropped EXE 1 IoCs

pid	Process
5632	105.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-20_59099f3062e23c55e3b7fe51a6581e8f_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	105.tmp

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 1 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
5632	105.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4720 wrote to memory of 5632	4720	2026-04-20_59099f3062e23c55e3b7fe51a6581e8f_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-20_59099f3062e23c55e3b7fe51a6581e8f_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-20_59099f3062e23c55e3b7fe51a6581e8f_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4720
- C:\Users\Admin\AppData\Local\Temp\105.tmp
  "C:\Users\Admin\AppData\Local\Temp\105.tmp" --pingC:\Users\Admin\AppData\Local\Temp\2026-04-20_59099f3062e23c55e3b7fe51a6581e8f_elex_mafia_stealc_tofsee.exe D135D1A2DA3BC251A578244B92B49C0FB1C846F58D868C31973E8A8B1604778C895CA8D2E9250A9CDEF80B39F68DCD53253C43FBABE07540016FE9F24CF8B57E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  PID:5632

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

105.tmp

Path C:\Users\Admin\AppData\Local\Temp\105.tmp
Size 411KB
SHA256 203ce60377a881da7c4db1a4b44e53e64d310ddba8c9ea6d915df016ffab6a52
MD5 2fb483bd9caa7ca495746a20a7b1c48c
SHA1 9642c3defa27dd8b82458a3f9e8c7835b97e4bec
SHA512 b867887c9f6ec4b335d1eea1fb985b51923d08608b2147ae47ce351ae435aa734d9a9ba2e9edcda4693e87c00144c79b087fb586decc52e1bb8d0c7cb8b72026
SSDEEP 12288:gZLolhNVyEHXEb9mOI2R44yCU2fRpdqH:gZqhOE3Eb9mOyk
TLSH
T19E94D025B281C036D18301314AF6D736293A7DB15B65A8CBB7D83B7E1E753D1A63A30B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads