1ea947ab46357b5c4db371be4c182369a0767b2e5e8156de199c3a2bab3be50a

Analysis

max time kernel
149s
max time network
153s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 13:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260423-qerm5aev3w
SHA256 1ea947ab46357b5c4db371be4c182369a0767b2e5e8156de199c3a2bab3be50a
MD5 2705bc5a47e5ff77c08cccc3d8749802
SHA1 db2245ff71bb68ffd8a0c89f7d45df42cb639e8f
SHA512 955173f96af4d94a3196d6e913413451ee3b08be249f4fdf3c9fd4e0cf1d80bc919895f7fbb2915ea0f7d94b6b74211c8b74964d5d5ecc5908b8cbcf111b708a
SSDEEP 12288:Ci4g+yU+0pAiv+f41/h949y5IBt4kb/gT98AdhRwhKn:Ci4gXn0pD+fw/X49yoi6/FUhGY
TLSH
T11894F0313552C033E1A705344FE6CB56667E79A54B26A8CB3BD40BAE2E603D2D73930B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4440	FDD8.tmp

Executes dropped EXE 1 IoCs

pid	Process
4440	FDD8.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FDD8.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4928 wrote to memory of 4440	4928	2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4928
- C:\Users\Admin\AppData\Local\Temp\FDD8.tmp
  "C:\Users\Admin\AppData\Local\Temp\FDD8.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_2705bc5a47e5ff77c08cccc3d8749802_elex_mafia_stealc_tofsee.exe 574066FEEF41E92937C21BF3C565614EB7E0B6010FBF8169228320E25D968C3030C6BECBFD1D9186912E447FB68866D8A0B98B7D0EABFA8B85D887F5D610B2D8
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4440

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

FDD8.tmp

Path C:\Users\Admin\AppData\Local\Temp\FDD8.tmp
Size 433KB
SHA256 d54c57539e85b095eb050723934f37513fa9e74a1b09573e86e0d9b2e00df7a0
MD5 837805fff7fb5df5e3b7eb7cd38b0d44
SHA1 9b80e58aee64daca3dec18605c0b9a5429ef2e64
SHA512 941ffb52985b8fb0f353f4963a851b141870fa18ad7683be76ee8eb6e89001e1ddda94585eba53e90da11786bab9a15e9f2c6f99ba5a06db47623da84e8d7b75
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtv3ZL8ziznrxw41zD/0csNIxFeyKlo1fx7n:Ci4g+yU+0pAiv+hg6xw4ZDU8FZK0ln
TLSH
T11794F1213182C033E2A719314BF5C7A9667E39B50726A8CB7BD40B7E7E642D2E275347
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download