9824ef789a0c27bb0ad8cfc09b02f0150062a63d0b289342bf7ad834fd04bf00

Analysis

max time kernel
149s
max time network
147s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 16:37

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe
Size 486KB
Sample260423-t42feaa17x
SHA256 9824ef789a0c27bb0ad8cfc09b02f0150062a63d0b289342bf7ad834fd04bf00
MD5 08255f2112232890f9e74cbf6a520972
SHA1 a31088fdf5ff2f226a3f1c0175d0833849b3113b
SHA512 31f3ff121fef1a982a27caa4000fe9e586769ae81f925792f507dc973fe2e1b9a8154c422dda43e52fe4676f724bc8d47861fed4e8e39c26fbdc1910c8d1f504
SSDEEP 12288:3O4rfItL8HPfJfiRiMELvI3oEgS317rKxUYXhW:3O4rQtGPdiMLiCS313KxUYXhW
TLSH
T107B4E12A76418233D28301315BDADBD6AB3E79B5472694C33794427D1FA1BE2D33A387
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2396	48FB.tmp

Executes dropped EXE 1 IoCs

pid	Process
2396	48FB.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	48FB.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4304 wrote to memory of 2396	4304	2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe	84

C:\Users\Admin\AppData\Local\Temp\2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4304
- C:\Users\Admin\AppData\Local\Temp\48FB.tmp
  "C:\Users\Admin\AppData\Local\Temp\48FB.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_08255f2112232890f9e74cbf6a520972_elex_mafia_stealc_tofsee.exe D17DA58A01B695A434CFFC9823DF60A82CBD73EC21DF2D5396F952DC243BAC031C0CAFDC17296E81C67BC36E9A11EC870940BB8F32E05820203F1B12EA993EFF
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:2396

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

48FB.tmp

Path C:\Users\Admin\AppData\Local\Temp\48FB.tmp
Size 486KB
SHA256 20e2a2bf9a818d39add6aab45c01d755d45c109eaf12d0f75ad44da0aeab9473
MD5 0e4c9b76440ef6d597a02bc23619b7ca
SHA1 73ba1f809b6ec665bece851af1710f98c5b15972
SHA512 232b21e55acb0cac463955337823da67db0ccd185929779c5578dbf3c91009f386ae7cdd6cef62cee7f44751bc9785c4228efd9ac940ec6851a28c849a430167
SSDEEP 12288:3O4rfItL8HPfIkKk4p0Q40ZARayCs3Jx7rKxUYXhW:3O4rQtGPdKkurYaxQx3KxUYXhW
TLSH
T12DB4F126B2418233D2C302755BDADBD6BA3EB5B14726D4C327D8027D0F65AE1D37A34A
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/2396-5-0x0000000000C20000-0x00000000011D3000-memory.dmp

Download

memory/4304-3-0x0000000001150000-0x0000000001703000-memory.dmp