691cb74a046cf73713728bd6156b6af0b612cc34c0acefc99d08ff4a099e6048

Analysis

max time kernel
149s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
22/04/2026, 15:58

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe
Size 414KB
Sample260422-ter6faay4k
SHA256 691cb74a046cf73713728bd6156b6af0b612cc34c0acefc99d08ff4a099e6048
MD5 90e17fbe12b2d35277f9d4b3fa70ca89
SHA1 8be5094657264fd024001e2a99d4ff8f031f9fdd
SHA512 a3f41d95f60a1e6b6889ea3a9e75264a370f308652cb66a8c9645fcda250e1afa98e71262690def7cd6b2c6d163c8733f9ec22c5a409573bd3fb836ef3b313a7
SSDEEP 6144:Wucyz4obQmKkWb6ekie+ogU6BYtA5z5+fWz1elagsxnVws8WU3yA/JUXOpAIHEir:Wq4w/ekieZgU66AFLz1eyN4djPEilx
TLSH
T18494E0217682C037E1A706344BE5CB6A693D7DA14B32A8C73BD42BAE5E706D1DB34347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4528	3D71.tmp

Executes dropped EXE 1 IoCs

pid	Process
4528	3D71.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	3D71.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4300 wrote to memory of 4528	4300	2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe	83

C:\Users\Admin\AppData\Local\Temp\2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4300
- C:\Users\Admin\AppData\Local\Temp\3D71.tmp
  "C:\Users\Admin\AppData\Local\Temp\3D71.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-22_90e17fbe12b2d35277f9d4b3fa70ca89_elex_mafia_stealc_tofsee.exe 5DBDE593B4C302948221B9D099C2E485FC487FCFA019935FC4BD71CF4A7724FE6CBC4ABDC9F58F34EE9FCC139AC635AAD436506848F1652AEB1EFE8FC958F167
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4528

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

3D71.tmp

Path C:\Users\Admin\AppData\Local\Temp\3D71.tmp
Size 414KB
SHA256 de88845ec4c56cf41cc55031ed39ec91b502ab0883465ea6281e5fbf417ff2ab
MD5 3d65a8b045134b7b02e164fc2885d3cc
SHA1 8ffa03dc11d85f11c9b4e1de0b70aa628b640ede
SHA512 2012c0c94a3c6d3913bf56be9d74b7cd61ab1645830495898a940b4f15926418e325d728904afaf715e859b4c98e48fb68c9cc334f2f35e181c44d5ad4e91dc9
SSDEEP 12288:Wq4w/ekieZgU6wih2yWJSKW3IQW6tVu3nfpq0ulx:Wq4w/ekieH6NSSXtUvpq0ur
TLSH
T1A994DF353586C037E26705388BE5CBAA593E3D604B26A8C73BD42BAE6E742D1D734347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download