3a79e7dd1342fd083b90fb6cb7193dbf03699a4c1317886605c7ef8803f6bf76

Analysis

max time kernel
149s
max time network
142s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 15:49

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe
Size 435KB
Sample260423-s9lrgagy6l
SHA256 3a79e7dd1342fd083b90fb6cb7193dbf03699a4c1317886605c7ef8803f6bf76
MD5 7586fe9dfefe00cfdc14a4ab96b8baac
SHA1 0205b03a47ddcbe5d8623dd79baf10846a074441
SHA512 0b1593b60d6bd338614243713abf6f284384b98fd1f0458cf660d8b52dc4c8a90be531e922431d27d1680672cd0dcc9da294a554fa147cfe4eb1e8602c83b96e
SSDEEP 12288:fd4x+ePixnXQjnvWmW6cKzCXwdbiavLwP:fd4x+ePixAjnWKriavL
TLSH
T17F94E0213646C037E1A616394AF4DBAA59397DB04B32A4C73BC42BAE5F742D1DB3434B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4728	1ECE.tmp

Executes dropped EXE 1 IoCs

pid	Process
4728	1ECE.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1ECE.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4592 wrote to memory of 4728	4592	2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4592
- C:\Users\Admin\AppData\Local\Temp\1ECE.tmp
  "C:\Users\Admin\AppData\Local\Temp\1ECE.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_7586fe9dfefe00cfdc14a4ab96b8baac_elex_mafia_stealc_tofsee.exe D9135B04547B4F1B4B3F987F4F67EFA6D98DBB8DD0055EAD5F61A9CBBFF9342013C8D9277A0E017563335A9FFA6F29AC72AEFD031A2280AB8902CC5EEA93890C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4728

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1ECE.tmp

Path C:\Users\Admin\AppData\Local\Temp\1ECE.tmp
Size 435KB
SHA256 641f6bb00d7b50506a9647f79448dc1b0f20744b84f751e9f8cb2491f4adb53a
MD5 e744f10707cc61cb57b7960d4ac58f1a
SHA1 ea766f099411319d427d427c3f1bc3f455aad416
SHA512 201b98533b8a5217447c4c1b025f50d57c8dce55c9ca09594e9ea0963446e0ba94ad5df037eaf7a443ebadd73dd9b081df85431598f8a0814fd8d90956cb1524
SSDEEP 6144:fJvyW4ojUnQjx4qePix+qXQjBYPr4RmhFwqPe8p5PmRRdJBc2BKkZh25Yb/RZfRQ:fd4x+ePixnXQj0r4Rwwi/5Y1ZZwP
TLSH
T13D94E1207682C077E2A206348BF1CBAA597A7D744B36A4C73BD027AE5F642D2D734357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/4592-3-0x0000000001460000-0x0000000001600000-memory.dmp

Download

memory/4728-5-0x0000000000D10000-0x0000000000EB0000-memory.dmp