35e5a3e51d73d5a7bbc62e82ba16a93da6160acd7e003e1e32ae9dcaa7c077e5

Analysis

max time kernel
149s
max time network
144s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 16:17

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe
Size 444KB
Sample260423-trpwvaax2s
SHA256 35e5a3e51d73d5a7bbc62e82ba16a93da6160acd7e003e1e32ae9dcaa7c077e5
MD5 63c8ea9a42cd502bfde684c6da98f981
SHA1 4839a055e05ea45b2efcc30f0c58539a84f435f9
SHA512 034e74dfdab515f79afb84521338ae8971ae18337c14b9b65178e21438c0cb0fa4650ed03f939dde9ba02677f92a0fbdda9c4ae4d4e6452b3e3e530904876d7d
SSDEEP 12288:Nb4bZudi79LdvsCgvBw4t55Na8L1fPUA:Nb4bcdkLmb5w4t5S8R
TLSH
T1A6A4E0243582C037E19716384AEADB76657E7AB10B2268C73BE45B7D2EB03D2D634347
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4480	F56C.tmp

Executes dropped EXE 1 IoCs

pid	Process
4480	F56C.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	F56C.tmp

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 4332 wrote to memory of 4480	4332	2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4332
- C:\Users\Admin\AppData\Local\Temp\F56C.tmp
  "C:\Users\Admin\AppData\Local\Temp\F56C.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_63c8ea9a42cd502bfde684c6da98f981_elex_mafia_stealc_tofsee.exe CB8B9C30CDD4ACA4D71249A508F76ED3E03AF6865E788FC8C63CA7986FE811891605710B6D2FEB2627B3A88C0830A5A4E8F0F006F920C607BCF9267D6603746C
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4480

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

F56C.tmp

Path C:\Users\Admin\AppData\Local\Temp\F56C.tmp
Size 444KB
SHA256 e268bd0d7f3e5e617416ab9140e2c7a779785c45b4d7ac298f061e542029fdc5
MD5 fe898469a0505c7d5654ca23faca7864
SHA1 b30cdf266151a16790e3179b132725b542710f82
SHA512 4612540b6ba6755fa1650fb17ba9817905c0902ac29ec8cddefab9cad351c3686331a42b8e40563a1129f3fc89bd3a470dbe295c4c3b36f716d7803bad9d0304
SSDEEP 12288:Nb4bZudi79LoiSNfAc2/p2tGPLIRNl/icAA:Nb4bcdkLoJNf9GPyNla
TLSH
T1ACA4F1243581C03BD1A715354BE6CB756A7E39A14B6268CB3BD42BAD5EB43E2E334343
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download