1cb7090a3a4e9526d8c4a50b75975fa0840be79da99a030f216a8c0a10b79b60

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 13:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_1477632db1457ff5607d252c955fbabf_elex_mafia_stealc_tofsee.exe
Size 468KB
Sample260423-qkfstaew6v
SHA256 1cb7090a3a4e9526d8c4a50b75975fa0840be79da99a030f216a8c0a10b79b60
MD5 1477632db1457ff5607d252c955fbabf
SHA1 8ba4482d67074d48383f57dd6fe5869056acb93a
SHA512 a689d54ba86753b280581d29a0a9643195da2073d66d884cee47349b76eab97b248ff8ea6ccf606aef6395dec29875469507033bacfc807ccbe3933ab5c5280d
SSDEEP 12288:qO4rfItL8HGRv3M5EIlKRKR5p/eMH4ymsA87bWmeEVGL:qO4rQtGGF3M5xKqNH4/v8umeEVGL
TLSH
T1AAA4F1267281C233D29302755BE6D7AAB73E74B54322A4C73BD4427E1E612D1D33A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
1656	4F05.tmp

Executes dropped EXE 1 IoCs

pid	Process
1656	4F05.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_1477632db1457ff5607d252c955fbabf_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4F05.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 1656	2400	2026-04-23_1477632db1457ff5607d252c955fbabf_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-23_1477632db1457ff5607d252c955fbabf_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_1477632db1457ff5607d252c955fbabf_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Users\Admin\AppData\Local\Temp\4F05.tmp
  "C:\Users\Admin\AppData\Local\Temp\4F05.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_1477632db1457ff5607d252c955fbabf_elex_mafia_stealc_tofsee.exe 53EA98712D1D514BDE7F4D74BA7833B68AF11FB4D94C9BA7C8BEB44D730CB46E2C79B6D043A469098F1DC71BC5E13F9902881D67979E486DA2E704FA4A6E5092
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:1656

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4F05.tmp

Path C:\Users\Admin\AppData\Local\Temp\4F05.tmp
Size 468KB
SHA256 6b2bd4207340d73c16da9ffe32b031780156875d109d25dc378ef37db84f636d
MD5 69c9e7b4983e5db93253c52d3ecba8f9
SHA1 499baeed8217b84b8e1d5a25c194f4a4c36cd56f
SHA512 035e02fa7fd7fb5bd7401445e3746428085f3a33bd05e42982524d8cd90ced5deb60152d105d5adbac8bec8723d8d9f27ef9d00113b7e0369f381f2de4d6b85c
SSDEEP 12288:qO4rfItL8HGbW76UiDBb2WKFI19Jojl7bWmeEVGL:qO4rQtGGbWWUiZ2RFw9JojlumeEVGL
TLSH
T1C3A4F13676408133D29301311BE6DBA6AA3E79B04726A4C33BD4427D1FA57E1D77A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2400-4-0x0000000000B50000-0x0000000000B69000-memory.dmp

Download