2d975cb79f285175f4a6a407c705fcaf9a4275dedda5b9395e36b1f9a4f856a6

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20260130-en
resource tags

arch:x64arch:x86image:win10v2004-20260130-enlocale:en-usos:windows10-2004-x64systemwindows
submitted
23/04/2026, 16:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe
Size 433KB
Sample260423-tsb2daax4t
SHA256 2d975cb79f285175f4a6a407c705fcaf9a4275dedda5b9395e36b1f9a4f856a6
MD5 929eaf89e8b7c12ac1c2a46ecf9696e3
SHA1 7dae517c50f0982a83cf28fe274f8575b63ee265
SHA512 e40da248d4e1c83629abc5d389c73cd311241dac755d2b8b4c75b3aef863e12c17a9bea7d2285eb666665383726b127760fee46dd2fd106ce440eb3c35a6b88d
SSDEEP 6144:Cajdz4sTdDyyqiOXpOd0p6Jiv+vtvL0+ePQwLBc6f/063MWZm5PDqfquH7XSgzn:Ci4g+yU+0pAiv+l0rPQwlbxmtp1cn
TLSH
T12994F1353581C033E6A715344BE5DBAA15BE35B15722A8CB3BD41B7E2E603C2E63934B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

discovery

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
4148	1807.tmp

Executes dropped EXE 1 IoCs

pid	Process
4148	1807.tmp

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	1807.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe

Suspicious use of WriteProcessMemory 1 IoCs

description	pid	Process	procid_target
PID 5076 wrote to memory of 4148	5076	2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe	85

C:\Users\Admin\AppData\Local\Temp\2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe
"C:\Users\Admin\AppData\Local\Temp\2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:5076
- C:\Users\Admin\AppData\Local\Temp\1807.tmp
  "C:\Users\Admin\AppData\Local\Temp\1807.tmp" --helpC:\Users\Admin\AppData\Local\Temp\2026-04-23_929eaf89e8b7c12ac1c2a46ecf9696e3_elex_mafia_stealc_tofsee.exe 8DAE70335FE745F9E8B1241E8872CC652C19D6ECB4409764F0027C778906CA9E101FF69D4C527240F6B8A283D29F23DCC2EC4EF1DF6B6576BA7C42DF2265B01E
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  PID:4148

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1807.tmp

Path C:\Users\Admin\AppData\Local\Temp\1807.tmp
Size 433KB
SHA256 cccfd99018c2ad89aae5f6386ac7be40e05366b20cfa1d3f95e083715e1888f4
MD5 b611cc17c87c5a5f79e2b7e0a3987446
SHA1 b19c85d648f50a2c118b6f6cae87b2c3ba836b75
SHA512 493d79d1bacd0fd7292450f885bc442227beb2e4e617c61bef29515faaf944abeb7d857bf04d70f1c537f93fd77a3e8f56c163b588d8a13c03913a322c3f8cf4
SSDEEP 12288:Ci4g+yU+0pAiv+SZ0KT5hf60rZS5Q85e7Xkn:Ci4gXn0pD+0pff6QZ2jck
TLSH
T18C94F0313282C033E2A619344BF5C76565BE7AA54B2264CB7BD01BBE6EA43D2C734357
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

memory/5076-4-0x0000000000D00000-0x0000000000D19000-memory.dmp

Download