ded219cda0123eba2c74c9b91c9a8486fef4233277f8d8f8fe8aff976ee13a39

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
21/04/2026, 14:02

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-21_862686ae7a99b66e78dbdbc67d4986d2_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260421-rccxmabt21
SHA256 ded219cda0123eba2c74c9b91c9a8486fef4233277f8d8f8fe8aff976ee13a39
MD5 862686ae7a99b66e78dbdbc67d4986d2
SHA1 08326008be905a08473270219695825f0b71510a
SHA512 1cda4348b98102dcc9c1a93e22be903fc69a0458cb58ad9830595f37f012b06962be409332ce83c545a4baeced2e2148d633710bebe301654713779a1c590446
SSDEEP 12288:Nb4bZudi79LPHdqQ8vXHXNIm0h/5uj+A:Nb4bcdkLVqQ8vXHXCUj
TLSH
T1B4A4F1253582C037E2A711384FE5DB76657E79B54B2268C73B941BBD1EB02E2EA30347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4996	13A2.tmp

Executes dropped EXE 1 IoCs

pid	Process
4996	13A2.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	13A2.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-21_862686ae7a99b66e78dbdbc67d4986d2_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 1996 wrote to memory of 4996	1996	2026-04-21_862686ae7a99b66e78dbdbc67d4986d2_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-21_862686ae7a99b66e78dbdbc67d4986d2_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-21_862686ae7a99b66e78dbdbc67d4986d2_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1996
- C:\Users\Admin\AppData\Local\Temp\13A2.tmp
  "C:\Users\Admin\AppData\Local\Temp\13A2.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-21_862686ae7a99b66e78dbdbc67d4986d2_elex_mafia_stealc_tofsee.exe 2DFC9ACAFAE8D932DA1B21CD61294E621B958BF953ED71CCD74761E16E27D0A37EDAB5DAFD435452FDE8785540591BEB3AB2625CE0DE6F6074EC17058A0D6906
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4996

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

13A2.tmp

Path C:\Users\Admin\AppData\Local\Temp\13A2.tmp
Size 444KB
SHA256 0799b180438090164e7dc02467216aa1233a5480241467152ece190197044dcc
MD5 cdd7cb11a4540262f524de6fa1d182b8
SHA1 2e9e11b064529b58530fd0ea5d5dccb6e828c3b0
SHA512 4ceb6a69e7f75e866bcb5488eafeb890b1a5622473b8a391c2635f8e6b7d47e3aafa04f69ab742ec7f2969077a8b16d9c5d04191a82999bc0999ec9d06d5fde9
SSDEEP 12288:Nb4bZudi79LH7L3zy5uDgdpuankF3gPmrRMVH6A:Nb4bcdkL+Ic+Fvrs
TLSH
T197A4F1243682C037E2A702344EE2DBA5697A79B14B2668C73BD46BBD1EF02D1D734357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/1996-3-0x00000000013D0000-0x00000000013E9000-memory.dmp

Download