484ddf183d0e585c955b75398b1545af7cde4c4f52175971c52f504197b6d0de

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 15:52

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_40a8309c8c6ec809f225f95faafd610e_elex_mafia_stealc_tofsee.exe
Size 476KB
Sample260423-ta3rdagz2p
SHA256 484ddf183d0e585c955b75398b1545af7cde4c4f52175971c52f504197b6d0de
MD5 40a8309c8c6ec809f225f95faafd610e
SHA1 2f5559e8ec15a4ffbc0f65ef251b629bd8511d8f
SHA512 eba57869dade0bc4e30b5d3f9928a39f33e3fca10e29ef51b34ad512d37980afb75f737f9a659e79dc7760e92df82915da231aa440645181ec183f2f66671f42
SSDEEP 12288:aO4rfItL8HRCjdpisoaqT+kAfDQhsY7qO+er3A9K7K9wlsDpVFd:aO4rQtGRCjni9bYTYOz5c+9wlsDpVFd
TLSH
T14CA4F12A76858133D2D302741BEACBE6A63E79741329A4C337D4067D2F61AE1D37A347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3160	1827.tmp

Executes dropped EXE 1 IoCs

pid	Process
3160	1827.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_40a8309c8c6ec809f225f95faafd610e_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1827.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 3484 wrote to memory of 3160	3484	2026-04-23_40a8309c8c6ec809f225f95faafd610e_elex_mafia_stealc_tofsee.exe	86

C:\Users\Admin\AppData\Local\Temp\2026-04-23_40a8309c8c6ec809f225f95faafd610e_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_40a8309c8c6ec809f225f95faafd610e_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3484
- C:\Users\Admin\AppData\Local\Temp\1827.tmp
  "C:\Users\Admin\AppData\Local\Temp\1827.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_40a8309c8c6ec809f225f95faafd610e_elex_mafia_stealc_tofsee.exe 94FA3F1A43452B60425D57D07201CD271F2BE7A6A8C3771B509BBD2347D25D282E8B17C55798CCFF9B2887842BA7F49B4197CD8685F62584B58C810FFB44288A
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:3160

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1827.tmp

Path C:\Users\Admin\AppData\Local\Temp\1827.tmp
Size 476KB
SHA256 f5349d2e58748769cfdc6179285b09beb83e78c0d922cbaa46a0e707a295a841
MD5 07cc9e013af7853137e32b05ebc0a4dc
SHA1 9d9effae5e96bce42aaf2d77b975626b92d7f4a8
SHA512 4571664e73572ce18814ddb2ea9a70572c5908f5f97c970619dffc81533f9624cd2091929bf28dd3c1c49902aca7f0ad7545a351bff69371fdee3903eeff8ef8
SSDEEP 12288:aO4rfItL8HR4LmWN4MnhuAQ0i/3GT8r7K9wlsDpVFd:aO4rQtGRomU404KT8r+9wlsDpVFd
TLSH
T1FAA4E02A3681C133E1D302345BDAC7A6AA3E78B5432694C73BD4027D1F656E1EB7934B
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/3160-5-0x00000000012B0000-0x00000000012F5000-memory.dmp

Download

memory/3484-4-0x0000000000EF0000-0x0000000000F35000-memory.dmp