e43b682e739c798ded5aa9ae9c35e3169eb529ca849b09a051978537f50cd7fc

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 15:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe
Size 479KB
Sample260423-sycdnaht21
SHA256 e43b682e739c798ded5aa9ae9c35e3169eb529ca849b09a051978537f50cd7fc
MD5 2efe27711f96c3ae2ddbaa5c58c25b87
SHA1 aa6fbe6bc655d8ff0de6e788aa3decd11d0f21b6
SHA512 9201ec89076ac080528e61e03d062f33730201af379220f79f6aa40132c5546f926c86a08153131001978cef6431f7c978ea27ab2b16ed4691c90ae0ef552ba3
SSDEEP 12288:bO4rfItL8HABR9MaVDPj4AcwjsIxmpe575UO:bO4rQtGABXVDr4APsIE85VUO
TLSH
T156A4F13A7241C133D29302755BE6DBAAAA3E35740762A4C777C8027D1F616E2D73A34B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4888	DAC0.tmp

Executes dropped EXE 1 IoCs

pid	Process
4888	DAC0.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	DAC0.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5080 wrote to memory of 4888	5080	2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5080
- C:\Users\Admin\AppData\Local\Temp\DAC0.tmp
  "C:\Users\Admin\AppData\Local\Temp\DAC0.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_2efe27711f96c3ae2ddbaa5c58c25b87_elex_mafia_stealc_tofsee.exe 6A9FDC25B9B8156E18FF77F4C27755AD1C995C9187E9A16EFBB7B3557BAB81B0A14DC9E2D49062D40937D2661C4628ABD281CF19773802E0DCF41D880E296BAD
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4888

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

DAC0.tmp

Path C:\Users\Admin\AppData\Local\Temp\DAC0.tmp
Size 479KB
SHA256 023046f6e2b3c99ac7424363186f2dce25548f050fb7f3b7baf4ce2854a5368d
MD5 b703e39ef39c2f81e9cc2c33f189fb08
SHA1 b771a24d7e3f71448eefe3744363c0c0451582f4
SHA512 a00fecdd893fbe14c9b31403a30a37e08566c5263a66e673395e131a79f92b3deb5bffc7663c5c529f07b8f7ee00df5cf0f40034944cba0f3069b09f218467d5
SSDEEP 12288:bO4rfItL8HAfFAec4acXXYZqtCFzSgPeHKv75UO:bO4rQtGAfFWgXswgWqvVUO
TLSH
T17FA4F139B681C133D29302711BD6EB6ABA3E75B1072694C33B9406BD1F61AE1D37934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download